Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Clear-TemplateSearch.b5003.SK048.ed.exe

Overview

General Information

Sample name:Clear-TemplateSearch.b5003.SK048.ed.exe
Analysis ID:1445864
MD5:2dff543405ed6f5fa29ba7cd047c22f7
SHA1:379778c2b2b20ebfb691a43a4f77271c43607715
SHA256:9809e3b5118a0c46c6001c6b0fe7bba654315759b67cc1295930b21d3748f8cf
Infos:

Detection

Score:30
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Multi AV Scanner detection for submitted file
Installs Task Scheduler Managed Wrapper
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches the installation path of Mozilla Firefox
Sigma detected: Use Short Name Path in Command Line
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • Clear-TemplateSearch.b5003.SK048.ed.exe (PID: 2000 cmdline: "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" MD5: 2DFF543405ED6F5FA29BA7CD047C22F7)
    • Clear-TemplateSearch.b5003.SK048.ed.tmp (PID: 6304 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" MD5: C76E26901E5B975415817DC6691B10FC)
      • 7zr.exe (PID: 8160 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\" -y MD5: 8693D7EA0B258EDF72C6EF7CFF1E46FB)
        • conhost.exe (PID: 8168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • 7zr.exe (PID: 1548 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium" -y MD5: 8693D7EA0B258EDF72C6EF7CFF1E46FB)
        • conhost.exe (PID: 712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Clear.exe (PID: 3380 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe" postinstall "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" "1.1.3.0" "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Profiles" "AutoStart_=true" "BuildVariant[]=" MD5: 26AE5F1918D76D1221ED90C7183BDC84)
        • clearbrowser.exe (PID: 7524 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 4816 cmdline: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\ClearBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=ClearBrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 7652 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 7696 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 4220 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 6000 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 7868 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 6760 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 5920 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 5532 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 7128 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 4708 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • clearbrowser.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 8076 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 8048 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 8132 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 6508 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 5472 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2 MD5: 973083D0D50F0C6369162207CA811C69)
          • clearbrowser.exe (PID: 3332 cmdline: "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8 MD5: 973083D0D50F0C6369162207CA811C69)
  • Clear.exe (PID: 4452 cmdline: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe MD5: 26AE5F1918D76D1221ED90C7183BDC84)
  • Clear.exe (PID: 5444 cmdline: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe update MD5: 26AE5F1918D76D1221ED90C7183BDC84)
  • Clear.exe (PID: 5828 cmdline: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe weather MD5: 26AE5F1918D76D1221ED90C7183BDC84)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line
Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp, ParentCommandLine: "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe", ParentImage: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe, ParentProcessId: 2000, ParentProcessName: Clear-TemplateSearch.b5003.SK048.ed.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" , ProcessId: 6304, ProcessName: Clear-TemplateSearch.b5003.SK048.ed.tmp

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: Clear-TemplateSearch.b5003.SK048.ed.exeReversingLabs: Detection: 33%
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D5806CCB-8635-4E7A-94FC-BF2723167477}_is1Jump to behavior
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: certificate valid
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\WpfAppBar\obj\Release\WpfAppBar.pdb4UNU @U_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\obj\Release\Clear.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.00000274571D9000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\WpfAppBar\obj\Release\WpfAppBar.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\s\GitHub\WpfScreenHelper\src\WpfScreenHelper\obj\Release\net40\WpfScreenHelper.pdbSHA256S source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: kernel32.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: chrome.dll.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbT*n* `*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: OTE:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$*>* 0*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb|( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@*Z* L*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb|( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: kernelbase.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\s\GitHub\WpfScreenHelper\src\WpfScreenHelper\obj\Release\net40\WpfScreenHelper.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: hromium\src\out\Default\initialexe\chrome.exe.pdbR source: clearbrowser.exe, 00000017.00000003.2491877314.000052F400040000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: me.exe.pdbut\Default\initialexe\chrome.exe.pdbbR source: clearbrowser.exe, 00000017.00000003.2491877314.000052F400040000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: X5WE:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: chrome.exe.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\chromium\src\out\Default\initialexe\chrome.exe.pdb source: clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: ntdll.pdb source: clearbrowser.exe, 00000017.00000002.2527474192.000052F400034000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00815C8D __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,9_2_00815C8D
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008179F9 FindFirstFileW,9_2_008179F9
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008166A3 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,9_2_008166A3
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\htmlJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewIP Address: 172.64.41.3 172.64.41.3
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: "weather": "https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203061_{user.InstallTime|format_mmddyy}", equals www.yahoo.com (Yahoo)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: url: "http://www.facebook.com" equals www.facebook.com (Facebook)
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: allowed_websitesAhttps://www.youtube.com|/embed,https://www.google.com|/maps/embed equals www.youtube.com (Youtube)
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.youtube.com|/embed,https://www.google.com|/maps/embed equals www.youtube.com (Youtube)
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: clearbrowser.exe, 00000012.00000003.2484099352.00003C2C0020C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003716000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456D98000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://creativecommons.org/ns#
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.r2m02.amazontrust.com/r2m02.crl0u
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: clearbrowser.exe, 0000001A.00000003.2503527895.0000180C0010C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503884876.0000180C002D8000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508850147.00002900002D8000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508190162.000029000010C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crrev.com/c/2555698.
Source: clearbrowser.exe, 00000018.00000003.2558813825.0000711000188000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.r2m
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2558813825.0000711000188000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.r2m02.amazontrust.com/r2m02.cer0
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-patterns).
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://o.aolcdn.com/images/dims?image_uri=https%3A%2F%2Fs.yimg.com%2Fos%2Fcreatr-uploaded-images%2F2
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://o.ss2.us/0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2558813825.0000711000188000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.r2m02.amazontrust.com06
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://s.ss2.us/r.crl0
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003716000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456D98000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1824228/751089
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/28210364/1070244
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://underscorejs.org/LICENSE
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types)
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.google.com/s2/favicons#domain=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/s2/favicons?domain=
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.hardcodet.net/taskbar
Source: clearbrowser.exe, 0000001A.00000003.2586334170.0000180C012FC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2506410407.0000180C00348000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2519441434.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513071281.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505893270.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513408195.0000180C00CB4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2511093714.0000180C010D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2521348250.0000180C009A4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590957361.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2518984899.0000180C00388000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510572267.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2585883712.0000180C014AC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2515405893.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590553519.0000180C0154C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505307176.0000180C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510039344.0000180C00AEC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0060C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2517847312.0000180C0080C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2584636838.0000180C0125C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2523515649.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.html5rocks.com/en/tutorials/canvas/hidpi/
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003716000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456D98000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1346101756.000000000CCE4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.json.org/json2.js
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.matts411.com/post/internet-explorer-9-oninput/
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.recipehub.com
Source: clearbrowser.exe, 0000001C.00000002.2564163878.0000015EC39B7000.00000002.00000001.00040000.0000001B.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://x.ss2.us/x.cer0&
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://0srzroz2i7.execute-api.us-east-1.amazonaws.com/api/v1/events
Source: clearbrowser.exe, 00000012.00000003.2523721594.00003C2C00714000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
Source: clearbrowser.exe, 00000012.00000003.2523721594.00003C2C00714000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/760
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://amazon.com
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://api.openweathermap.org/data/2.5/forecast/daily?
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://api.openweathermap.org/data/2.5/weather?
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=1049982
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=830565
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3443
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=182678
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=200829
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=773687
Source: clearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: clearbrowser.exe, 00000012.00000003.2493906597.00003C2C00977000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en-GB
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en-GBCtrl$1
Source: clearbrowser.exe, 00000012.00000003.2493906597.00003C2C00977000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en-GBd
Source: clearbrowser.exe, 00000012.00000003.2513894396.00003C2C005D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2540335336.00003C2C00D68000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2508117403.00003C2C00D60000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2508271151.00003C2C00CE4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2523033683.00003C2C00D90000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2540932684.00003C2C00D88000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2503959214.00003C2C00D60000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2542590763.00003C2C00D8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2508375356.00003C2C00D88000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2525108481.00003C2C007E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2514160326.00003C2C007E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2504032832.00003C2C00D68000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2516215728.00003C2C00D68000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2528435246.00003C2C00D60000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2529299572.00003C2C00D68000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2508196408.00003C2C00D68000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2542869038.00003C2C00CE8000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2542697033.00003C2C00B98000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2507250120.00003C2C005D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2522931019.00003C2C00D8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2503840334.00003C2C005D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstoreKCDiscover
Source: clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstorehttps://chromewebstore.google.com/6EAED1924DB611B6EEF2A664BD077BE7
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: clearbrowser.exe, 00000012.00000003.2484099352.00003C2C0020C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: clearbrowser.exe, 00000012.00000003.2484099352.00003C2C0020C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clearbar.app(https://clearbar.app(https://clearbar.app
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/?
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/privacy-policy/
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/privacy-policy/?
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=102941Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=239196Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=286375Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=374553Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=382844Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=401560Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=701Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/rd2/?id=7527Ly9hcmNhZGV0YWIuY29t&guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/terms-of-service/
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/terms-of-service/?
Source: Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app/updates/clearbar_updates.json?guid=
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://clearbar.app1
Source: clearbrowser.exe, 0000001C.00000002.2597590807.0000020400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/binaries/1.1.3.0/clear.7z
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/binaries/1.1.3.0/clearbrowser.7z
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/binaries/tutorials/%s.7z
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/adshield-v1090.xml
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/newtab-mv3-20220908.xml
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/newtab-ntlayout-20211214.xml
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/newtab-yahoo-20210224.xml
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/newtab-yahoo-20220131.xml
Source: clearbrowser.exe, 0000001C.00000003.2510513771.0000290000150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/staging/clearcore-v1070.xml
Source: clearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/staging/easyprint-v1056.xml
Source: clearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2609810289.0000290000028000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/staging/newtab-mv3-v1056.xml
Source: clearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/staging/zoomtool-v1056.xml
Source: clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/staging/zoomtool-v1056.xmlscript-src
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/extensions/ycontent-mv3.xml
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://cloudfront.clearbar.app/profiles/common.json=https://clearbar.app/profiles/ehttps://clearbar
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=286360
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/issues/detail?id=687
Source: clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://crashpad.chromium.org/
Source: clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
Source: clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: clearbrowser.exe, 0000001A.00000003.2586334170.0000180C012FC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2506410407.0000180C00348000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2519441434.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513071281.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505893270.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513408195.0000180C00CB4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2511093714.0000180C010D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2521348250.0000180C009A4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590957361.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2518984899.0000180C00388000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510572267.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2515405893.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590553519.0000180C0154C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505307176.0000180C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0060C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2517847312.0000180C0080C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2523515649.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2511882329.0000180C0080C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2584636838.0000180C012FC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510388206.0000180C007A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/740629)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://css-tricks.com/debouncing-throttling-explained-examples/)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/URL/revokeObjectURL
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://earth.google.com/web
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/).
Source: clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fullscreen.spec.whatwg.org/#user-agent-level-style-sheet-defaults:
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bestiejs/punycode.js/blob/master/punycode.js
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/es5-shim/issues/150
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/flow/issues/285
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/regenerator/issues/274
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/kitcambridge/es5-shim/commit/4f738ac066346
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/String.prototype.at
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla/rhino/issues/346
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/paldepind/snabbdom/blob/master/LICENSE
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sdecima/javascript-detect-element-resize
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-Symbol-description
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-array-filtering
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-class-component/blob/master/src/reflect.ts
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/2341
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/2639
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/3201
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/3225
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/3294
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/issues/3331
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vue-router/pull/3047
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vuejs/vuex/issues/1505
Source: clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/6939#issuecomment-1016679588
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/173
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/306
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/339
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/475
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/624
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/640
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/674
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/677
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/679
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
Source: clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/P
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/Pi
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://google.com
Source: clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/C/#the-details-and-summary-elements
Source: clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#flow-content-3
Source: clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#hidden-elements
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://instagram.com
Source: Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://ip2.clearbar.app/?token=8765FRCfs
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000000.1288116601.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lodash.com/license
Source: clearbrowser.exe, 00000012.00000003.2484099352.00003C2C0020C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://maps.google.com
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-unicode).
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2480593919.00007DE800308000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481573097.00003C2C001B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481174384.00003C2C0016C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481203481.00003C2C00178000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481264792.00003C2C001A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://meta.clearbar.app/sug/?s=
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://myactivity.google.com/
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://news.yahoo.com/finding-safe-haven-in-the-climate-change-future-the-southwest-100032145.html?
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://openweathermap.org/img/wn/
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://passwords.google.comSaved
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/N21QzeQA)
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pdf-services.clearbar.app/api/v1/auth/handoff
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pdf.live/
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://policies.google.com/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://poshmark.com/bundles/shop
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: clearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://s.easyrecipessearch-serp.com/public/home.html
Source: clearbrowser.exe, 00000012.00000003.2506430531.00003C2C002CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://samples.openweathermap.org/data/2.5/forecast/daily?id=524901&appid=b1b15e88fa797225412429c1c
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.clearbar.app/crx/search.php?guid=
Source: clearbrowser.exe, 00000012.00000003.2480593919.00007DE800308000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481573097.00003C2C001B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481203481.00003C2C00178000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481264792.00003C2C001A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.clearbar.app/crx/search.php?guid=173f77d4-1d21-45bb-8074-7fb83cfed713&q=
Source: Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://search.freshy.com/y-feeds/news/v1/topNews?length=-1
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com?fr=tightropetb&type=11745
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://something.com
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/6024666/getting-ie-to-replace-a-regex-with-the-literal-string-0
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://staging.newtab.ext.services/223/default/index.html?guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://staging.newtab.ext.services/223/staging-new/index.html?guid=
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/cart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://store.usps.com/store/cart/cart.jsp
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://system.data.sqlite.org/
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://tab.clearbar.app/223/clear/index.html?guid=
Source: clearbrowser.exe, 00000012.00000003.2480593919.00007DE800308000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2506430531.00003C2C002CC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481573097.00003C2C001B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481174384.00003C2C0016C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481203481.00003C2C00178000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2481264792.00003C2C001A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://tab.clearbar.app/223/edge/index.html?guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tab.clearbar.app/223/main/index.html?guid=
Source: 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://tab.clearbar.app/223/templates/index.html?guid=
Source: Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://tab.weathertab-site.info/85/clear/index.html?guid=
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-%arrayiteratorprototype%.next
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-%stringiteratorprototype%.next
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-advancestringindex
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.from
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype-
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.concat
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.entries
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.every
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.filter
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.find
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.findIndex
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.findindex
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.foreach
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.includes
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.indexof
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.join
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.keys
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.map
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.reduce
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.reduceright
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.slice
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.some
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.splice
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-array.prototype.values
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-arrayspeciescreate
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-createarrayiterator
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-createmappedargumentsobject
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-createunmappedargumentsobject
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-function-instances-name
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-get-regexp.prototype.flags
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-getsubstitution
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-isarray
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-isregexp
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-json.stringify
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-number-constructor
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-number.isnan
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.assign
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.create
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.defineproperties
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.defineproperty
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.entries
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.getownpropertydescriptor
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.getownpropertydescriptors
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.getownpropertynames
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.getownpropertysymbols
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.getprototypeof
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.keys
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.propertyisenumerable
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.setprototypeof
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.values
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.all
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.prototype.catch
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.prototype.finally
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.prototype.then
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.race
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.reject
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-promise.resolve
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-regexp.prototype-
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-regexp.prototype.tostring
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-regexpexec
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-requireobjectcoercible
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-speciesconstructor
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype-
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.codepointat
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.includes
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.replace
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.split
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.trim
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.trimend
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-string.prototype.trimstart
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol-constructor
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol.for
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol.iterator
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol.keyfor
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol.prototype-
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-symbol.prototype.description
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-tointeger
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-tolength
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-tonumber
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-toobject
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-toprimitive
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://twitter.com
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#URL-stringification-behavior
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-hash
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-host
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-hostname
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-href
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-origin
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-password
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-pathname
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-port
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-protocol
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-search
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-searchparams
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-tojson
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-url-username
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-append
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-delete
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-get
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-getall
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-has
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-set
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-sort
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#interface-urlsearchparams
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#url-class
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://us.search.yahoo.com/sugg/gossip/gossip-us-partner?output=jsonp&appid=tig&command=
Source: clearbrowser.exe, 0000001A.00000003.2586334170.0000180C012FC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2506410407.0000180C00348000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2519441434.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513071281.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505893270.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513408195.0000180C00CB4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2511093714.0000180C010D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2521348250.0000180C009A4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590957361.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2518984899.0000180C00388000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510572267.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2585883712.0000180C014AC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2515405893.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590553519.0000180C0154C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505307176.0000180C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510039344.0000180C00AEC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0060C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2517847312.0000180C0080C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2584636838.0000180C0125C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2523515649.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/gamepad/#remapping
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://weather-services.clearbar-api.app/api/get.php?action=onecall&type=cord
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://wikipedia.com
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1288548533.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.1292998904.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.google-analytics.com/collect
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
Source: clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
Source: clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlManaged
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.google.com/images/branding/googleg/1x/googleg_standard_color_128dp.png
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.google.com/maps/dir/?api=1
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
Source: clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.guitarcenter.com/cart
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000000.1291631926.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.petsmart.com/cart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.pier1.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.pokemoncenter.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.potterybarn.com/shoppingcart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.qvc.com/checkout/cart.html
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.redbubble.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rei.com/ShoppingCart
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000000.1291631926.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.revolve.com/r/ShoppingBag.jsp
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rockauto.com/en/cart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.saksfifthavenue.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.samsclub.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.sephora.com/basket
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.shutterfly.com/cart/
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.sqlite.org/copyright.html2
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.staples.com/cc/mmx/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.sweetwater.com/store/cart.php
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.talbots.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.target.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.teacherspayteachers.com/Cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.therealreal.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.tractorsupply.com/TSCShoppingCartView
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ulta.com/bag
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.underarmour.com/en-us/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.urbanoutfitters.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.vitalsource.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.walgreens.com/cart/view-ui
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.walmart.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wayfair.com/v/checkout/basket/show
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.weightwatchers.com/us/shop/checkout/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.westelm.com/shoppingcart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wiley.com/en-us/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.williams-sonoma.com/shoppingcart/
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wish.com/cart
Source: 7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203061_
Source: clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.youtube.com
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zappos.com/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zazzle.com/co/cart
Source: clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zennioptical.com/shoppingCart
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://youtube.com
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00818191: DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,9_2_00818191
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0084987F9_2_0084987F
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008520639_2_00852063
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0082E1C29_2_0082E1C2
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008742E09_2_008742E0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008606109_2_00860610
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008186679_2_00818667
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086A8C09_2_0086A8C0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008669369_2_00866936
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086ABE09_2_0086ABE0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086EC309_2_0086EC30
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00814C7B9_2_00814C7B
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00872D409_2_00872D40
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00868E809_2_00868E80
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00868F009_2_00868F00
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00860F409_2_00860F40
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086D0F09_2_0086D0F0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086B0009_2_0086B000
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008550279_2_00855027
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008610509_2_00861050
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008670709_2_00867070
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0085F1509_2_0085F150
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0085B4C09_2_0085B4C0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008115539_2_00811553
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008756239_2_00875623
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008757B19_2_008757B1
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0087588B9_2_0087588B
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008119459_2_00811945
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008759719_2_00875971
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0083BA1C9_2_0083BA1C
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086DCB09_2_0086DCB0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00869C179_2_00869C17
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00869C199_2_00869C19
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0086FC309_2_0086FC30
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00873C309_2_00873C30
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0082BD979_2_0082BD97
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00873DF09_2_00873DF0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00869F589_2_00869F58
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58B18023_2_00007FF7FD58B180
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD583F9023_2_00007FF7FD583F90
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58275E23_2_00007FF7FD58275E
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD585C6023_2_00007FF7FD585C60
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58176023_2_00007FF7FD581760
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58326023_2_00007FF7FD583260
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD583B6023_2_00007FF7FD583B60
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58A82023_2_00007FF7FD58A820
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58BE3223_2_00007FF7FD58BE32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58BF0023_2_00007FF7FD58BF00
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD583A0023_2_00007FF7FD583A00
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58AAE023_2_00007FF7FD58AAE0
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD583DF023_2_00007FF7FD583DF0
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 23_2_00007FF7FD58BBC023_2_00007FF7FD58BBC0
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58B18033_2_00007FF7FD58B180
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD583F9033_2_00007FF7FD583F90
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58275E33_2_00007FF7FD58275E
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD585C6033_2_00007FF7FD585C60
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58176033_2_00007FF7FD581760
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58326033_2_00007FF7FD583260
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD583B6033_2_00007FF7FD583B60
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58A82033_2_00007FF7FD58A820
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58BE3233_2_00007FF7FD58BE32
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58BF0033_2_00007FF7FD58BF00
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD583A0033_2_00007FF7FD583A00
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58AAE033_2_00007FF7FD58AAE0
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD583DF033_2_00007FF7FD583DF0
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeCode function: 33_2_00007FF7FD58BBC033_2_00007FF7FD58BBC0
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeProcess token adjusted: Security
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: String function: 00874F50 appears 519 times
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: String function: 00811C86 appears 160 times
Source: Clear-TemplateSearch.b5003.SK048.ed.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-KSDTH.tmp.2.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-4C1O9.tmp.2.drStatic PE information: Number of sections : 15 > 10
Source: is-OVDJG.tmp.2.drStatic PE information: Number of sections : 11 > 10
Source: is-7DLNC.tmp.2.drStatic PE information: Number of sections : 11 > 10
Source: is-9V0UG.tmp.2.drStatic PE information: Number of sections : 11 > 10
Source: is-RVMTK.tmp.2.drStatic PE information: Number of sections : 13 > 10
Source: is-63952.tmp.2.drStatic PE information: Number of sections : 12 > 10
Source: is-9R8D9.tmp.2.drStatic PE information: Number of sections : 12 > 10
Source: is-LI5F9.tmp.2.drStatic PE information: Number of sections : 11 > 10
Source: is-U1PHM.tmp.2.drStatic PE information: Number of sections : 12 > 10
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FE25000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs Clear-TemplateSearch.b5003.SK048.ed.exe
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002619000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs Clear-TemplateSearch.b5003.SK048.ed.exe
Source: Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000000.1288238004.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs Clear-TemplateSearch.b5003.SK048.ed.exe
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeRegistry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\118.0.1 (x64 en-US)\Main Install Directory
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engineClassification label: sus30.spyw.evad.winEXE@69/1595@0/15
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00818252 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,9_2_00818252
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00825A91 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,9_2_00825A91
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00818191 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,9_2_00818191
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:712:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\ClearbarInstallationMutex
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMutant created: \Sessions\1\BaseNamedObjects\com.clear.application
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeMutant created: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8168:120:WilError_03
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeFile created: C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmpJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: insert into top_sites (url, title, url_rank) values ('{0}','{1}',{2});
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Clear-TemplateSearch.b5003.SK048.ed.exeReversingLabs: Detection: 33%
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeFile read: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe"
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeProcess created: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe"
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\" -y
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium" -y
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe" postinstall "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" "1.1.3.0" "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Profiles" "AutoStart_=true" "BuildVariant[]="
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe"
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\ClearBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=ClearBrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe update
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe weather
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeProcess created: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp "C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\" -yJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium" -yJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe" postinstall "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" "1.1.3.0" "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Profiles" "AutoStart_=true" "BuildVariant[]="Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe"
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\ClearBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=ClearBrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: msiso.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: mshtml.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: srpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: jscript9.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: msimtf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: d2d1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: d3d10warp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: windowscodecsext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: msxml6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rasapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rasman.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rtutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dsreg.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: omadmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dmcmnutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: iri.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wpnapps.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: rmclient.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: usermgrcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: windows.media.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wlanapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: directmanipulation.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: wlanapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: pcpksp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: tbs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: ncryptprov.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windows.applicationmodel.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: thumbcache.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wpnapps.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rmclient.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: usermgrcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: d3dcompiler_47.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: d3dcompiler_47.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpAutomated click: Next
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Windows\explorer.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D5806CCB-8635-4E7A-94FC-BF2723167477}_is1Jump to behavior
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: certificate valid
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic file information: File size 4915184 > 1048576
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\WpfAppBar\obj\Release\WpfAppBar.pdb4UNU @U_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\obj\Release\Clear.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2100852873.00000000013E7000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.00000274571D9000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\gitlab-runner\builds\tb72VnLq\0\extension-prototypes\launchwebbar\WpfAppBar\obj\Release\WpfAppBar.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\s\GitHub\WpfScreenHelper\src\WpfScreenHelper\obj\Release\net40\WpfScreenHelper.pdbSHA256S source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: kernel32.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: chrome.dll.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbT*n* `*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: OTE:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$*>* 0*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb|( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@*Z* L*_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb|( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: kernelbase.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\s\GitHub\WpfScreenHelper\src\WpfScreenHelper\obj\Release\net40\WpfScreenHelper.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: hromium\src\out\Default\initialexe\chrome.exe.pdbR source: clearbrowser.exe, 00000017.00000003.2491877314.000052F400040000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: me.exe.pdbut\Default\initialexe\chrome.exe.pdbbR source: clearbrowser.exe, 00000017.00000003.2491877314.000052F400040000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: X5WE:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: chrome.exe.pdb source: clearbrowser.exe, 00000017.00000002.2527020624.000052F400018000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\chromium\src\out\Default\initialexe\chrome.exe.pdb source: clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: ntdll.pdb source: clearbrowser.exe, 00000017.00000002.2527474192.000052F400034000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: 7zr.exe, 00000009.00000003.2104091144.0000000003B57000.00000004.00001000.00020000.00000000.sdmp
Source: is-KSNII.tmp.2.drStatic PE information: 0xE6A8063F [Sun Aug 17 00:28:47 2092 UTC]
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00847352 GetCurrentProcess,GetProcessTimes,fputs,memset,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,__aulldiv,fputs,9_2_00847352
Source: Clear-TemplateSearch.b5003.SK048.ed.exeStatic PE information: section name: .didata
Source: Clear-TemplateSearch.b5003.SK048.ed.tmp.0.drStatic PE information: section name: .didata
Source: 7zr.exe.2.drStatic PE information: section name: .sxdata
Source: is-4C1O9.tmp.2.drStatic PE information: section name: .00cfg
Source: is-4C1O9.tmp.2.drStatic PE information: section name: .gxfg
Source: is-4C1O9.tmp.2.drStatic PE information: section name: .retplne
Source: is-4C1O9.tmp.2.drStatic PE information: section name: .rodata
Source: is-4C1O9.tmp.2.drStatic PE information: section name: CPADinfo
Source: is-4C1O9.tmp.2.drStatic PE information: section name: LZMADEC
Source: is-4C1O9.tmp.2.drStatic PE information: section name: _RDATA
Source: is-4C1O9.tmp.2.drStatic PE information: section name: malloc_h
Source: is-RVMTK.tmp.2.drStatic PE information: section name: .00cfg
Source: is-RVMTK.tmp.2.drStatic PE information: section name: .crthunk
Source: is-RVMTK.tmp.2.drStatic PE information: section name: .gxfg
Source: is-RVMTK.tmp.2.drStatic PE information: section name: .retplne
Source: is-RVMTK.tmp.2.drStatic PE information: section name: CPADinfo
Source: is-RVMTK.tmp.2.drStatic PE information: section name: _RDATA
Source: is-7DLNC.tmp.2.drStatic PE information: section name: .00cfg
Source: is-7DLNC.tmp.2.drStatic PE information: section name: .gxfg
Source: is-7DLNC.tmp.2.drStatic PE information: section name: .retplne
Source: is-7DLNC.tmp.2.drStatic PE information: section name: _RDATA
Source: is-9R8D9.tmp.2.drStatic PE information: section name: .00cfg
Source: is-9R8D9.tmp.2.drStatic PE information: section name: .gxfg
Source: is-9R8D9.tmp.2.drStatic PE information: section name: .retplne
Source: is-9R8D9.tmp.2.drStatic PE information: section name: LZMADEC
Source: is-9R8D9.tmp.2.drStatic PE information: section name: _RDATA
Source: is-63952.tmp.2.drStatic PE information: section name: .00cfg
Source: is-63952.tmp.2.drStatic PE information: section name: .gxfg
Source: is-63952.tmp.2.drStatic PE information: section name: .retplne
Source: is-63952.tmp.2.drStatic PE information: section name: CPADinfo
Source: is-63952.tmp.2.drStatic PE information: section name: _RDATA
Source: is-LI5F9.tmp.2.drStatic PE information: section name: .00cfg
Source: is-LI5F9.tmp.2.drStatic PE information: section name: .gxfg
Source: is-LI5F9.tmp.2.drStatic PE information: section name: .retplne
Source: is-LI5F9.tmp.2.drStatic PE information: section name: _RDATA
Source: is-OVDJG.tmp.2.drStatic PE information: section name: .00cfg
Source: is-OVDJG.tmp.2.drStatic PE information: section name: .gxfg
Source: is-OVDJG.tmp.2.drStatic PE information: section name: .retplne
Source: is-OVDJG.tmp.2.drStatic PE information: section name: _RDATA
Source: is-9V0UG.tmp.2.drStatic PE information: section name: .00cfg
Source: is-9V0UG.tmp.2.drStatic PE information: section name: .gxfg
Source: is-9V0UG.tmp.2.drStatic PE information: section name: .retplne
Source: is-9V0UG.tmp.2.drStatic PE information: section name: _RDATA
Source: is-U1PHM.tmp.2.drStatic PE information: section name: .00cfg
Source: is-U1PHM.tmp.2.drStatic PE information: section name: .gxfg
Source: is-U1PHM.tmp.2.drStatic PE information: section name: .retplne
Source: is-U1PHM.tmp.2.drStatic PE information: section name: CPADinfo
Source: is-U1PHM.tmp.2.drStatic PE information: section name: _RDATA
Source: is-KSDTH.tmp.2.drStatic PE information: section name: .didata
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_3_0129B790 push edx; ret 9_3_0129B7FD
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00860890 push ecx; mov dword ptr [esp], ecx9_2_00860891
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00874F50 push eax; ret 9_2_00874F6E
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008752F0 push eax; ret 9_2_0087531E
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00813C0B push 0087C33Ch; ret 9_2_00813C25
Source: HtmlInstaller.dll.2.drStatic PE information: section name: .text entropy: 6.858624423223641
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.RuntimeInformation.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Css.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Specialized.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TA0F6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.XDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-52JU8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ValueTuple.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ECL5N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_proxy.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tools.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\is-07PID.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Formatters.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Claims.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\is-OPN3R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R83ND.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AMMB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Bcl.AsyncInterfaces.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.ReaderWriter.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Hardcodet.NotifyIcon.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Model.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UL8PG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Gdi.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Overlapped.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.StackTrace.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Pipes.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Watcher.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PT87J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-23NVI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\is-KSDTH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.Client.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7I3RJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\is-S9RD1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Reader.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Algorithms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.ThreadPool.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2KU8B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Newtonsoft.Json.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Xml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Runtime.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\is-0JKHJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Handles.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.NonGeneric.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HM8L4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NetworkInformation.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RE807.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Humanizer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.SecureString.dllJump to dropped file
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeFile created: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-C6SSC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\Networking.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Reader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Encoding.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.TaskScheduler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HK51L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G0CR4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.SQLite.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tracing.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LPSKV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T78L9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RNFKH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DKN5Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G7ELA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Calendars.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-J8HOA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PJDAA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_pwa_launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Converters.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TextWriterTraceListener.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Parallel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.X509Certificates.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\notification_helper.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I8LB6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Debug.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0HAIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-75V95.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Gdi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\is-K585J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9R8D9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Console.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.VisualC.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MJB0T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHT9H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8OJM2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Toolkit.Uwp.Notifications.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Css.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-O56GI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.NonGeneric.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_pwa_launcher.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LJTH0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Parallel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.EventBasedAsync.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Parallel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MRCU1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R6FTJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.UnmanagedMemoryStream.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DD01F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.RegularExpressions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Algorithms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfAppBar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Dynamic.Runtime.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\is-CJS2F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5S69T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tools.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Ping.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.IsolatedStorage.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NameResolution.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UGLPU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebHeaderCollection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Runtime.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\es\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MKAC5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.ResourceManager.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GDD25.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Expressions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-4C1O9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.RegularExpressions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.Native.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6VU9P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQS09.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.Common.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Dynamic.Runtime.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Concurrent.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PQ410.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\HtmlInstaller.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AT07R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G4L6C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6SI67.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DOH0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\is-0FSFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Timer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Process.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.ReaderWriter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x64\SQLite.Interop.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6CHFM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tracing.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Greensoft.TlvLib.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Thread.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HBD8O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9GTP5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-N3995.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VJNDQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1MO1B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.MemoryMappedFiles.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Expressions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_elf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Formatters.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2A3U4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-7DLNC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7QFPE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.ThreadPool.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Ping.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.EventBasedAsync.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ObjectModel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ObjectModel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQ5MQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x86\SQLite.Interop.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.X509Certificates.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHV6Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SR0IF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TPNG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-RVMTK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UM03N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8HG11.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_proxy.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Debug.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Json.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-KSNII.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\LiteDB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-10GPT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-F4SJF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PCCLC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\is-QDMU5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpClipboard.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\is-NUUK3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-A2NCU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Principal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2QTC0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0286F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8UBLU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Writer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Drawing.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S7D15.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Encoding.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\netstandard.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.FileVersionInfo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DMRO6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Security.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EEO25.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Timer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libGLESv2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-OVDJG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MOF23.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-38F0A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.AppContext.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TraceSource.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlSerializer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\de\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Thread.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Contracts.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.Client.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Concurrent.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Specialized.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GBL9Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\elevation_service.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.DriveInfo.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.SecureString.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.VisualC.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\is-JKUT7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EV863.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6LN71.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Process.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\elevation_service.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Pipes.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I2HMI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.TaskScheduler.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Xml.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\clearbrowser.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SNP6L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B8O8E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.MemoryMappedFiles.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1T6AN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Contracts.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.Common.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IPQI0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-L44T9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Security.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-D8F8K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\is-NMB8V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Dom.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.FileVersionInfo.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-P1KJV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebHeaderCollection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.TypeConverter.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Watcher.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B3VJL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfScreenHelper.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-40NNL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9E9TN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R70VF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-K7VFE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7SD3T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UK4HH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Overlapped.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-NFO05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\netstandard.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\it\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GU2I5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.TypeConverter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Claims.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\fr\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9S7BD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-63952.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Numerics.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Dom.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Queryable.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-3FN0L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Sockets.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Http.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5HUBI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Networking.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RCDHE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LTI51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Numerics.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-4BM0B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-CN\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IHDF0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-96JN4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Sockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-LI5F9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Handles.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Writer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.ResourceManager.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Model.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQJI7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\SQLite.Interop.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.AppContext.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Requests.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NetworkInformation.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HESRK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.ZipFile.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.Abstractions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2MB65.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TraceSource.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I7MF9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Console.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ETVL9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\pl\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Parallel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-U1PHM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Principal.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9V0UG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ARVMU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Core.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.Native.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-OFPQN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TextWriterTraceListener.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\ru\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-FA10R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-CJA9H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NameResolution.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Requests.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.ZipFile.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Csp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Drawing.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Calendars.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5A214.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libEGL.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AS9AU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfScreenHelper.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2L6P2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PO9RP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Json.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Queryable.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TBP4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T0A69.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S6HAT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GNMM8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UJRG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\SQLite.Interop.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-20DGM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Greensoft.TlvLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.StackTrace.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2AFRA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.DriveInfo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.IsolatedStorage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Humanizer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Toolkit.Uwp.Notifications.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R43LO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5FC31.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.UnmanagedMemoryStream.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlSerializer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VR258.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2O16F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.XDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Converters.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Csp.dll (copy)Jump to dropped file

Boot Survival

barindex
Installs Task Scheduler Managed Wrapper
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeFile created: C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.TaskScheduler.dll
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Clear.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpSection loaded: OutputDebugStringW count: 112
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeSection loaded: OutputDebugStringW count: 202
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 3580000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 4160000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 6160000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 9D50000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: A020000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: A1A0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: A1C0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CC60000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CD00000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CD80000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CDC0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CDE0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CE40000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: CE60000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: D390000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: D3D0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: D3F0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: DC30000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: DC50000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: F7B0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: F7D0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: EE50000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: EF50000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: F750000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: F770000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: BB0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: BD0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: E280000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 101D0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10210000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10230000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10250000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10CD0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10D70000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10D90000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10DD0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: 10DF0000 memory commit | memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 27457510000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 27470EE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 264AFF80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 264C8080000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 25FA9CE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 25FC1E50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 1C9ECFC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeMemory allocated: 1C9EEA80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpThread delayed: delay time: 499984Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpWindow / User API: threadDelayed 2843Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpWindow / User API: threadDelayed 2851Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1917
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1136
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 2145
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1444
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 3615
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1880
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1782
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeWindow / User API: threadDelayed 1367
Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 401
Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 405
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.RuntimeInformation.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Css.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Specialized.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.XDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TA0F6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-52JU8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ValueTuple.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ECL5N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_proxy.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tools.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\is-07PID.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Formatters.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Claims.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\is-OPN3R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R83ND.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AMMB0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Bcl.AsyncInterfaces.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.ReaderWriter.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Hardcodet.NotifyIcon.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Model.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UL8PG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Gdi.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Overlapped.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.StackTrace.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Pipes.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Watcher.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PT87J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-23NVI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.Client.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\is-S9RD1.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7I3RJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Reader.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.ThreadPool.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Algorithms.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2KU8B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Newtonsoft.Json.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Xml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Runtime.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Handles.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\is-0JKHJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.NonGeneric.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HM8L4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NetworkInformation.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RE807.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.SecureString.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Humanizer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\Networking.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-C6SSC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Reader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Encoding.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.TaskScheduler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G0CR4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HK51L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.SQLite.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tracing.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LPSKV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T78L9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RNFKH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DKN5Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G7ELA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Calendars.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-J8HOA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Converters.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PJDAA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_pwa_launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TextWriterTraceListener.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Parallel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.X509Certificates.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\notification_helper.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I8LB6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Debug.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-75V95.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0HAIA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Gdi.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\is-K585J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9R8D9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.VisualC.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Console.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MJB0T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHT9H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Toolkit.Uwp.Notifications.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8OJM2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Css.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-O56GI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.NonGeneric.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_pwa_launcher.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LJTH0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Parallel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.EventBasedAsync.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Parallel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R6FTJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.UnmanagedMemoryStream.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DD01F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.RegularExpressions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Algorithms.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfAppBar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Dynamic.Runtime.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\is-CJS2F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tools.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5S69T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Ping.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.IsolatedStorage.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NameResolution.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UGLPU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebHeaderCollection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Runtime.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\es\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MKAC5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.ResourceManager.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GDD25.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Expressions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-4C1O9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.RegularExpressions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.Native.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6VU9P.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQS09.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.Common.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Dynamic.Runtime.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Concurrent.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PQ410.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\HtmlInstaller.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AT07R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G4L6C.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6SI67.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DOH0U.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\is-0FSFV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Timer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Process.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.ReaderWriter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x64\SQLite.Interop.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tracing.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6CHFM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Greensoft.TlvLib.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Thread.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HBD8O.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9GTP5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-N3995.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VJNDQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1MO1B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.MemoryMappedFiles.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Expressions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_elf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Formatters.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2A3U4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-7DLNC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7QFPE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.ThreadPool.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Ping.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.EventBasedAsync.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ObjectModel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ObjectModel.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQ5MQ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x86\SQLite.Interop.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.X509Certificates.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHV6Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SR0IF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TPNG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-RVMTK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UM03N.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_proxy.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8HG11.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Debug.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Json.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-KSNII.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\LiteDB.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-10GPT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-F4SJF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PCCLC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\is-QDMU5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpClipboard.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\is-NUUK3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Wpf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-A2NCU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Principal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2QTC0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0286F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8UBLU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Writer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Drawing.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S7D15.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Encoding.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\netstandard.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.FileVersionInfo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DMRO6.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Security.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EEO25.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Timer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libGLESv2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-OVDJG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-38F0A.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MOF23.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.AppContext.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TraceSource.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlSerializer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Thread.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\de\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlDocument.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Contracts.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.Client.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Specialized.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Concurrent.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GBL9Q.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\elevation_service.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.DriveInfo.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.SecureString.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.VisualC.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\is-JKUT7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EV863.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6LN71.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Process.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\elevation_service.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Pipes.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I2HMI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.TaskScheduler.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Xml.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.MemoryMappedFiles.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SNP6L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B8O8E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Contracts.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1T6AN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.Common.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IPQI0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-L44T9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Security.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-D8F8K.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\is-NMB8V.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Dom.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.FileVersionInfo.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-P1KJV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebHeaderCollection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.TypeConverter.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B3VJL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Watcher.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfScreenHelper.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-40NNL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9E9TN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R70VF.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7SD3T.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-K7VFE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Overlapped.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UK4HH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-NFO05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\netstandard.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\it\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GU2I5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.TypeConverter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Extensions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Claims.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\fr\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9S7BD.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Numerics.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Dom.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Queryable.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-3FN0L.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Sockets.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Http.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5HUBI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Networking.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LTI51.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RCDHE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Numerics.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-4BM0B.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-CN\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IHDF0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-96JN4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Sockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Handles.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-LI5F9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Writer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.ResourceManager.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Model.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQJI7.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\SQLite.Interop.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Requests.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.AppContext.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NetworkInformation.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HESRK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.ZipFile.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.Abstractions.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Extensions.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2MB65.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TraceSource.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I7MF9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Console.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ETVL9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\pl\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Parallel.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Principal.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-U1PHM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.Primitives.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9V0UG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ARVMU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Core.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.Native.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-OFPQN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TextWriterTraceListener.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\ru\Microsoft.Win32.TaskScheduler.resources.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-FA10R.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-CJA9H.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NameResolution.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Requests.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.ZipFile.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Csp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Drawing.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Calendars.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Primitives.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5A214.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libEGL.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AS9AU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfScreenHelper.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2L6P2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PO9RP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Json.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Queryable.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TBP4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T0A69.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S6HAT.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GNMM8.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UJRG2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\SQLite.Interop.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\Microsoft.Win32.TaskScheduler.resources.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Greensoft.TlvLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-20DGM.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.StackTrace.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2AFRA.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.DriveInfo.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.IsolatedStorage.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Humanizer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Toolkit.Uwp.Notifications.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R43LO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5FC31.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.UnmanagedMemoryStream.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlSerializer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VR258.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2O16F.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.XDocument.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Converters.Wpf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Csp.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp TID: 6732Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp TID: 6732Thread sleep time: -100000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp TID: 6732Thread sleep time: -499984s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7328Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 2756Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7300Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 1664Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 2756Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 5500Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7520Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 5248Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 5876Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7520Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 2708Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 1008Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7688Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7148Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 1008Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 6824Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 2868Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7180Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 7596Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe TID: 2868Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\webui_js FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\js FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\wasm FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\blob_storage\509a7680-8606-463e-9369-3b3cf5bd28f1 FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile Volume queried: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00815C8D __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,9_2_00815C8D
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008179F9 FindFirstFileW,9_2_008179F9
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_008166A3 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,9_2_008166A3
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_0081890F GetSystemInfo,9_2_0081890F
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpThread delayed: delay time: 100000Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpThread delayed: delay time: 499984Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeThread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\htmlJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000003.2263566518.000000000A71A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00847352 GetCurrentProcess,GetProcessTimes,fputs,memset,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,__aulldiv,fputs,9_2_00847352
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpMemory allocated: page read and write | page guardJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\" -yJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium" -yJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe"
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\ClearBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=ClearBrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\clear.exe" postinstall "c:\users\user\desktop\clear-templatesearch.b5003.sk048.ed.exe" "1.1.3.0" "c:\users\user~1\appdata\local\temp\is-nd9cl.tmp\profiles" "autostart_=true" "buildvariant[]="
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\clearbrowser\user data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\clearbrowser\user data\crashpad" --annotation=plat=win64 --annotation=prod=clearbrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.profileimport --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.processormetrics --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\clear.exe" postinstall "c:\users\user\desktop\clear-templatesearch.b5003.sk048.ed.exe" "1.1.3.0" "c:\users\user~1\appdata\local\temp\is-nd9cl.tmp\profiles" "autostart_=true" "buildvariant[]="Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\clearbrowser\user data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\clearbrowser\user data\crashpad" --annotation=plat=win64 --annotation=prod=clearbrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.profileimport --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.datadecoderservice --lang=en-gb --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeProcess created: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe "c:\users\user\appdata\local\programs\clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.processormetrics --lang=en-gb --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
Source: 7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Networking.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\HtmlInstaller.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Greensoft.TlvLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfScreenHelper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\master_preferences VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Preferences VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\ongdnllcjkgccaaeenpnccdmgnoakclk\1.22.1206_0\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\ongdnllcjkgccaaeenpnccdmgnoakclk\1.22.1206_0\icons\16.png VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\lhgbhkaddoclgompehjgnoabldpmpkno\1.22.916_0\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\lhgbhkaddoclgompehjgnoabldpmpkno\1.22.916_0\icons\16.png VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\hnaldbmaaihebfkndlpogamgccddckad\1.22.718_0\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extensions\hnaldbmaaihebfkndlpogamgccddckad\1.22.718_0\icons\16.png VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\013888a1cda32b90_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\297ecea5cebb5dfe_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Toolkit.Uwp.Notifications.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\System32\WinMetadata\Windows.ApplicationModel.winmd VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\System32\WinMetadata\Windows.Foundation.winmd VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.WindowsRuntime\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\System32\WinMetadata\Windows.Storage.winmd VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\System32\WinMetadata\Windows.UI.winmd VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeQueries volume information: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00818A69 GetSystemTimeAsFileTime,9_2_00818A69
Source: C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exeCode function: 9_2_00860AB0 GetVersionExW,9_2_00860AB0
Source: C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exeFile opened: C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\History

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts21
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		1
OS Credential Dumping		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		1
Windows Service		1
Access Token Manipulation		1
Deobfuscate/Decode Files or Information		LSASS Memory4
File and Directory Discovery		Remote Desktop Protocol1
Browser Session Hijacking		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Command and Scripting Interpreter		11
Scheduled Task/Job		1
Windows Service		3
Obfuscated Files or Information		Security Account Manager39
System Information Discovery		SMB/Windows Admin Shares1
Data from Local System		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts11
Scheduled Task/Job		1
Registry Run Keys / Startup Folder		12
Process Injection		1
Software Packing		NTDS1
Query Registry		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script11
Scheduled Task/Job		1
Timestomp		LSA Secrets21
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Registry Run Keys / Startup Folder		1
DLL Side-Loading		Cached Domain Credentials2
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Masquerading		DCSync151
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job151
Virtualization/Sandbox Evasion		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadow2
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
Process Injection		Network Sniffing1
Remote System Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1445864 Sample: Clear-TemplateSearch.b5003.... Startdate: 22/05/2024 Architecture: WINDOWS Score: 30 104 Multi AV Scanner detection for submitted file 2->104 9 Clear-TemplateSearch.b5003.SK048.ed.exe 2 2->9         started        12 Clear.exe 2->12         started        15 Clear.exe 2->15         started        17 Clear.exe 2->17         started        process3 dnsIp4 82 Clear-TemplateSearch.b5003.SK048.ed.tmp, PE32 9->82 dropped 19 Clear-TemplateSearch.b5003.SK048.ed.tmp 47 517 9->19         started        100 18.245.86.18 AMAZON-02US United States 12->100 102 172.67.70.239 CLOUDFLARENETUS United States 15->102 file5 process6 dnsIp7 88 142.250.185.238 GOOGLEUS United States 19->88 90 34.205.103.86 AMAZON-AESUS United States 19->90 92 2 other IPs or domains 19->92 58 C:\Users\user\AppData\Local\Temp\...\7zr.exe, PE32 19->58 dropped 60 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->60 dropped 62 C:\Users\user\AppData\...62etworking.dll, PE32 19->62 dropped 64 289 other files (none is malicious) 19->64 dropped 108 Tries to delay execution (extensive OutputDebugStringW loop) 19->108 24 7zr.exe 19->24         started        28 Clear.exe 19->28         started        30 7zr.exe 19->30         started        file8 signatures9 process10 file11 66 Microsoft.Win32.Ta...duler.resources.dll, PE32 24->66 dropped 68 Microsoft.Win32.Ta...duler.resources.dll, PE32 24->68 dropped 70 C:\Users\user\AppData\...\SQLite.Interop.dll, PE32 24->70 dropped 78 130 other files (none is malicious) 24->78 dropped 110 Installs Task Scheduler Managed Wrapper 24->110 32 conhost.exe 24->32         started        112 Tries to delay execution (extensive OutputDebugStringW loop) 28->112 34 clearbrowser.exe 28->34         started        72 C:\Users\user\...\notification_helper.exe, PE32+ 30->72 dropped 74 C:\Users\user\AppData\Local\...\libGLESv2.dll, PE32+ 30->74 dropped 76 C:\Users\user\AppData\Local\...\libEGL.dll, PE32+ 30->76 dropped 80 6 other files (none is malicious) 30->80 dropped 39 conhost.exe 30->39         started        signatures12 process13 dnsIp14 84 192.168.2.7 unknown unknown 34->84 86 239.255.255.250 unknown Reserved 34->86 50 C:\Users\user\AppData\Local\...\History, SQLite 34->50 dropped 52 C:\...\the-real-index~RF6c1678.TMP (copy), PDP-11 34->52 dropped 54 C:\Users\user\...\the-real-index (copy), PDP-11 34->54 dropped 56 C:\Users\user\AppData\Local\...\temp-index, PDP-11 34->56 dropped 106 Tries to harvest and steal browser information (history, passwords, etc) 34->106 41 clearbrowser.exe 34->41         started        44 clearbrowser.exe 34->44         started        46 clearbrowser.exe 34->46         started        48 17 other processes 34->48 file15 signatures16 process17 dnsIp18 94 18.164.96.2 MIT-GATEWAYSUS United States 41->94 96 142.250.186.142 GOOGLEUS United States 41->96 98 5 other IPs or domains 41->98

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Clear-TemplateSearch.b5003.SK048.ed.exe33%ReversingLabsWin32.PUA.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_elf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_proxy.exe (copy)4%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_pwa_launcher.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\elevation_service.exe (copy)4%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-63952.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-7DLNC.tmp4%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9R8D9.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9V0UG.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-LI5F9.tmp4%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-OVDJG.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-RVMTK.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-U1PHM.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libEGL.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libGLESv2.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\notification_helper.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.Native.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Greensoft.TlvLib.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Humanizer.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Toolkit.Uwp.Notifications.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.Primitives.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.TaskScheduler.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Converters.Wpf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Core.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Css.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Dom.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Model.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Gdi.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Wpf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Runtime.Wpf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.AppContext.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Concurrent.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.NonGeneric.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Specialized.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.EventBasedAsync.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.Primitives.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.TypeConverter.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Console.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.Common.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Contracts.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Debug.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.FileVersionInfo.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Process.dll (copy)0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing0%URL Reputationsafe
https://support.google.com/chrome/answer/60988690%URL Reputationsafe
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new0%URL Reputationsafe
https://www.youtube.com0%URL Reputationsafe
https://photos.google.com/settings?referrer=CHROME_NTP0%URL Reputationsafe
https://www.remobjects.com/ps0%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl0%URL Reputationsafe
https://www.innosetup.com/0%URL Reputationsafe
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object0%URL Reputationsafe
http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).0%URL Reputationsafe
https://crashpad.chromium.org/0%URL Reputationsafe
https://github.com/mozilla/rhino/issues/3460%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-promise.prototype.finally0%Avira URL Cloudsafe
https://api.openweathermap.org/data/2.5/forecast/daily?0%Avira URL Cloudsafe
https://clearbar.app/rd2/?id=374553Ly9hcmNhZGV0YWIuY29t&guid=0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-promise.prototype.then0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-tonumber0%Avira URL Cloudsafe
https://search.yahoo.com?fr=tightropetb&type=117450%Avira URL Cloudsafe
https://url.spec.whatwg.org/#dom-urlsearchparams-append0%Avira URL Cloudsafe
https://publickeyservice.gcp.privacysandboxservices.com0%Avira URL Cloudsafe
http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)0%URL Reputationsafe
https://www.therealreal.com/cart0%Avira URL Cloudsafe
http://underscorejs.org/LICENSE0%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl0%URL Reputationsafe
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd0%URL Reputationsafe
https://amazon.com0%URL Reputationsafe
https://m.google.com/devicemanagement/data/api0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume0%URL Reputationsafe
https://mathiasbynens.be/notes/javascript-unicode).0%URL Reputationsafe
https://github.com/zloirock/core-js/issues/6400%Avira URL Cloudsafe
https://github.com/tc39/proposal-array-filtering0%Avira URL Cloudsafe
https://www.urbanoutfitters.com/cart0%Avira URL Cloudsafe
https://www.shutterfly.com/cart/0%Avira URL Cloudsafe
https://url.spec.whatwg.org/#dom-url-search0%Avira URL Cloudsafe
https://www.zappos.com/cart0%Avira URL Cloudsafe
http://www.hardcodet.net/taskbar0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-toprimitive0%Avira URL Cloudsafe
https://www.saksfifthavenue.com/cart0%Avira URL Cloudsafe
https://www.guitarcenter.com/cart0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.foreach0%Avira URL Cloudsafe
https://tab.clearbar.app/223/edge/index.html?guid=0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-string.prototype.codepointat0%Avira URL Cloudsafe
http://www.html5rocks.com/en/tutorials/canvas/hidpi/0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.some0%Avira URL Cloudsafe
https://url.spec.whatwg.org/#dom-url-tojson0%Avira URL Cloudsafe
https://github.com/es-shims/es5-shim/issues/1500%Avira URL Cloudsafe
https://chrome.google.com/webstorehttps://chromewebstore.google.com/6EAED1924DB611B6EEF2A664BD077BE70%Avira URL Cloudsafe
http://crt.r2m02.amazontrust.com/r2m02.cer00%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-promise.all0%Avira URL Cloudsafe
https://staging.newtab.ext.services/223/default/index.html?guid=0%Avira URL Cloudsafe
https://www.williams-sonoma.com/shoppingcart/0%Avira URL Cloudsafe
https://search.clearbar.app/crx/search.php?guid=0%Avira URL Cloudsafe
https://developer.mozilla.org/en-US/docs/Web/API/URL/revokeObjectURL0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-createarrayiterator0%Avira URL Cloudsafe
https://github.com/zloirock/core-js/issues/3060%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-symbol.prototype.description0%Avira URL Cloudsafe
http://ocsp.r2m02.amazontrust.com060%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.from0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-number.isnan0%Avira URL Cloudsafe
https://instagram.com0%Avira URL Cloudsafe
https://chrome.google.com/webstore0%Avira URL Cloudsafe
https://cloudfront.clearbar.app/profiles/common.json=https://clearbar.app/profiles/ehttps://clearbar0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-object.defineproperty0%Avira URL Cloudsafe
http://ocsp.rootca1.amazontrust.com0:0%Avira URL Cloudsafe
https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid=0%Avira URL Cloudsafe
https://www.teacherspayteachers.com/Cart0%Avira URL Cloudsafe
https://url.spec.whatwg.org/#dom-url-hostname0%Avira URL Cloudsafe
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity0%Avira URL Cloudsafe
https://fullscreen.spec.whatwg.org/#user-agent-level-style-sheet-defaults:0%Avira URL Cloudsafe
http://crl.rootg2.amazontrust.com/rootg2.crl00%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-getsubstitution0%Avira URL Cloudsafe
https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-symbol.keyfor0%Avira URL Cloudsafe
https://pdf-services.clearbar.app/api/v1/auth/handoff0%Avira URL Cloudsafe
https://www.qvc.com/checkout/cart.html0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-function-instances-name0%Avira URL Cloudsafe
http://o.aolcdn.com/images/dims?image_uri=https%3A%2F%2Fs.yimg.com%2Fos%2Fcreatr-uploaded-images%2F20%Avira URL Cloudsafe
https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid=0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.values0%Avira URL Cloudsafe
https://www.samsclub.com/cart0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-object.values0%Avira URL Cloudsafe
https://earth.google.com/web0%Avira URL Cloudsafe
https://cloudfront.clearbar.app/extensions/newtab-yahoo-20220131.xml0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.map0%Avira URL Cloudsafe
https://cloudfront.clearbar.app/extensions/ycontent-mv3.xml0%Avira URL Cloudsafe
https://url.spec.whatwg.org/#dom-url-password0%Avira URL Cloudsafe
https://github.com/mathiasbynens/String.prototype.at0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.slice0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-array.prototype.splice0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-arrayspeciescreate0%Avira URL Cloudsafe
https://tc39.github.io/ecma262/#sec-symbol.prototype-0%Avira URL Cloudsafe
https://github.com/zloirock/core-js/issues/6790%Avira URL Cloudsafe
https://search.freshy.com/y-feeds/news/v1/topNews?length=-10%Avira URL Cloudsafe
http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters0%Avira URL Cloudsafe
https://github.com/zloirock/core-js/issues/6770%Avira URL Cloudsafe
https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid=0%Avira URL Cloudsafe
https://publickeyservice.pa.gcp.privacysandboxservices.com0%Avira URL Cloudsafe
https://cloudfront.clearbar.app/extensions/staging/zoomtool-v1056.xml0%Avira URL Cloudsafe
https://github.com/zloirock/core-js/issues/6740%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://github.com/mozilla/rhino/issues/3467zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-promise.prototype.finally7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingclearbrowser.exe, 00000012.00000003.2506430531.00003C2C002CC000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://api.openweathermap.org/data/2.5/forecast/daily?7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://support.google.com/chrome/answer/6098869clearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpfalse
  • URL Reputation: safe
unknown
https://tc39.github.io/ecma262/#sec-tonumber7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://url.spec.whatwg.org/#dom-urlsearchparams-append7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://search.yahoo.com?fr=tightropetb&type=117457zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newclearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpfalse
  • URL Reputation: safe
unknown
https://clearbar.app/rd2/?id=374553Ly9hcmNhZGV0YWIuY29t&guid=7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://publickeyservice.gcp.privacysandboxservices.comclearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-promise.prototype.then7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.therealreal.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/zloirock/core-js/issues/6407zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.youtube.comclearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.shutterfly.com/cart/clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.urbanoutfitters.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/tc39/proposal-array-filtering7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://photos.google.com/settings?referrer=CHROME_NTPclearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpfalse
  • URL Reputation: safe
unknown
https://url.spec.whatwg.org/#dom-url-search7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.saksfifthavenue.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.zappos.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.hardcodet.net/taskbar7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-toprimitive7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.guitarcenter.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.remobjects.com/psClear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000000.1291631926.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
  • URL Reputation: safe
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrlclearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpfalse
  • URL Reputation: safe
unknown
https://tab.clearbar.app/223/edge/index.html?guid=7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.foreach7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.some7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.innosetup.com/Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1289586745.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.exe, 00000000.00000003.1290014289.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Clear-TemplateSearch.b5003.SK048.ed.tmp, 00000002.00000000.1291631926.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
  • URL Reputation: safe
unknown
https://tc39.github.io/ecma262/#sec-string.prototype.codepointat7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.html5rocks.com/en/tutorials/canvas/hidpi/clearbrowser.exe, 0000001A.00000003.2586334170.0000180C012FC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2506410407.0000180C00348000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2519441434.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513071281.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505893270.0000180C005B0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2513408195.0000180C00CB4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2511093714.0000180C010D4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2521348250.0000180C009A4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590957361.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2518984899.0000180C00388000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510572267.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2585883712.0000180C014AC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2515405893.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2590553519.0000180C0154C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0064C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505307176.0000180C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2510039344.0000180C00AEC000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2505086561.0000180C0060C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2517847312.0000180C0080C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2584636838.0000180C0125C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2523515649.0000180C00C8C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://crt.r2m02.amazontrust.com/r2m02.cer0clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2558813825.0000711000188000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://url.spec.whatwg.org/#dom-url-tojson7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/es-shims/es5-shim/issues/1507zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chrome.google.com/webstorehttps://chromewebstore.google.com/6EAED1924DB611B6EEF2A664BD077BE7clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-promise.all7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/en-US/docs/Web/API/URL/revokeObjectURL7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://staging.newtab.ext.services/223/default/index.html?guid=7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://search.clearbar.app/crx/search.php?guid=7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://crashpad.chromium.org/clearbrowser.exe, 00000012.00000000.2470045911.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000013.00000000.2473734042.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000017.00000000.2484249021.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000018.00000000.2488829459.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 00000019.00000000.2493953464.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001A.00000000.2497102026.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmp, clearbrowser.exe, 0000001C.00000000.2501592584.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpfalse
  • URL Reputation: safe
unknown
https://tc39.github.io/ecma262/#sec-symbol.prototype.description7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.williams-sonoma.com/shoppingcart/clearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-createarrayiterator7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/zloirock/core-js/issues/3067zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.from7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-number.isnan7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://ocsp.r2m02.amazontrust.com06clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2558813825.0000711000188000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-object.defineproperty7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chrome.google.com/webstoreclearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://instagram.com7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://cloudfront.clearbar.app/profiles/common.json=https://clearbar.app/profiles/ehttps://clearbar7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://url.spec.whatwg.org/#dom-url-hostname7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.teacherspayteachers.com/Cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid=7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://ocsp.rootca1.amazontrust.com0:clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivityclearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://fullscreen.spec.whatwg.org/#user-agent-level-style-sheet-defaults:clearbrowser.exe, 0000001A.00000003.2504222722.0000180C002F0000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503912412.0000180C002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503736154.0000180C00144000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001A.00000003.2503665134.0000180C00170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2509598278.00002900002E4000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2508452878.0000290000170000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000003.2510021199.00002900002F0000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.qvc.com/checkout/cart.htmlclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-symbol.keyfor7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://pdf-services.clearbar.app/api/v1/auth/handoff7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://underscorejs.org/LICENSE7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tc39.github.io/ecma262/#sec-getsubstitution7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://crl.rootg2.amazontrust.com/rootg2.crl0clearbrowser.exe, 00000012.00000003.2524815657.00003C2C0088C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000012.00000003.2524953996.00003C2C00D4C000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2526920362.0000711000714000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2523768493.0000711000148000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 00000018.00000003.2524087774.0000711000730000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://o.aolcdn.com/images/dims?image_uri=https%3A%2F%2Fs.yimg.com%2Fos%2Fcreatr-uploaded-images%2F27zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrlclearbrowser.exe, 0000001C.00000002.2577310758.0000015EC3FE0000.00000002.00000001.00040000.00000020.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-function-instances-name7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid=7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmp, 7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.values7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-object.values7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.samsclub.com/cartclearbrowser.exe, 00000012.00000003.2485492957.00003C2C0060C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd7zr.exe, 00000009.00000003.2104091144.0000000003716000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456D98000.00000002.00000001.01000000.00000014.sdmpfalse
  • URL Reputation: safe
unknown
https://amazon.com7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • URL Reputation: safe
unknown
https://earth.google.com/web7zr.exe, 00000009.00000003.2104091144.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://m.google.com/devicemanagement/data/apiclearbrowser.exe, 00000012.00000003.2484099352.00003C2C0020C000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://cloudfront.clearbar.app/extensions/newtab-yahoo-20220131.xml7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.map7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chromewebstore.google.com/clearbrowser.exe, 0000001C.00000002.2597861425.0000020400258000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://cloudfront.clearbar.app/extensions/ycontent-mv3.xml7zr.exe, 00000009.00000003.2104091144.00000000037ED000.00000004.00001000.00020000.00000000.sdmp, Clear.exe, 0000000D.00000000.2404125642.0000027456E6F000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://url.spec.whatwg.org/#dom-url-password7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/mathiasbynens/String.prototype.at7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.slice7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-array.prototype.splice7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-symbol.prototype-7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/zloirock/core-js/issues/6797zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tc39.github.io/ecma262/#sec-arrayspeciescreate7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://search.freshy.com/y-feeds/news/v1/topNews?length=-1Clear.exe, 0000000D.00000000.2404125642.0000027456CC2000.00000002.00000001.01000000.00000014.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/zloirock/core-js/issues/6777zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://mathiasbynens.be/notes/javascript-unicode).7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid=7zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://publickeyservice.pa.gcp.privacysandboxservices.comclearbrowser.exe, 00000017.00000002.2498110098.0000027B3FC30000.00000002.10000000.00040000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2543488016.0000015EC2DB0000.00000002.10000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://cloudfront.clearbar.app/extensions/staging/zoomtool-v1056.xmlclearbrowser.exe, 0000001A.00000003.2504512695.0000180C00150000.00000004.00001000.00020000.00000000.sdmp, clearbrowser.exe, 0000001C.00000002.2610203411.000029000004C000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/zloirock/core-js/issues/6747zr.exe, 00000009.00000003.2083605173.0000000003140000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
1.1.1.1
unknownAustralia
13335CLOUDFLARENETUSfalse
142.250.186.170
unknownUnited States
15169GOOGLEUSfalse
18.239.69.89
unknownUnited States
16509AMAZON-02USfalse
18.239.69.107
unknownUnited States
16509AMAZON-02USfalse
142.251.40.234
unknownUnited States
15169GOOGLEUSfalse
18.164.96.2
unknownUnited States
3MIT-GATEWAYSUSfalse
142.250.185.238
unknownUnited States
15169GOOGLEUSfalse
74.125.206.84
unknownUnited States
15169GOOGLEUSfalse
172.67.70.239
unknownUnited States
13335CLOUDFLARENETUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
34.205.103.86
unknownUnited States
14618AMAZON-AESUSfalse
142.250.186.142
unknownUnited States
15169GOOGLEUSfalse
18.245.86.18
unknownUnited States
16509AMAZON-02USfalse
172.64.41.3
unknownUnited States
13335CLOUDFLARENETUSfalse

Private

IP
192.168.2.7

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1445864
Start date and time:2024-05-22 17:38:21 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 13m 15s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:Run with higher sleep bypass
Number of analysed new started processes analysed:42
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:1
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Clear-TemplateSearch.b5003.SK048.ed.exe
Detection:SUS
Classification:sus30.spyw.evad.winEXE@69/1595@0/15
EGA Information:
  • Successful, ratio: 14.3%
HCA Information:
  • Successful, ratio: 62%
  • Number of executed functions: 97
  • Number of non-executed functions: 135
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Execution Graph export aborted for target clearbrowser.exe, PID 4708 because there are no executed function
  • Execution Graph export aborted for target clearbrowser.exe, PID 7652 because there are no executed function
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtEnumerateKey calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtReadVirtualMemory calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: Clear-TemplateSearch.b5003.SK048.ed.exe

Simulations

Behavior and APIs

TimeTypeDescription
19:34:54Task SchedulerRun new task: ClearStartAtLoginTask path: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
19:34:54Task SchedulerRun new task: ClearUpdateChecker path: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe s>update
19:34:54Task SchedulerRun new task: ClearWeatherCheck path: C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe s>weather

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
  • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
  • 1.1.1.1/
INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
  • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
Go.exeGet hashmaliciousUnknownBrowse
  • 1.1.1.1/
239.255.255.250https://url10.mailanyone.net/scanner?m=1s944h-0002To-5d&d=4%7Cmail%2F90%2F1716215400%2F1s944h-0002To-5d%7Cin10e%7C57e1b682%7C12862802%7C10019077%7C664B5F2B87AB20AB3656F0529EAA66DD&o=%2Fphtn%3A%2Fits-ftefceoraoefi.ognclmoc&s=TEjbZJDtuXxOW0FjTVUpySy9uwYGet hashmaliciousUnknownBrowse
    https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154faGet hashmaliciousUnknownBrowse
      https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
        http://www.cpcheckme.comGet hashmaliciousUnknownBrowse
          https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/Get hashmaliciousHTMLPhisherBrowse
            https://forfbidrecrossboot.pages.dev/503.jsGet hashmaliciousUnknownBrowse
              https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphta%3A%2Fvtslekssiaipcr.te%2Ftoenscino-x-pk%2F6tRunvbhyfphp.x&s=qPX4ToIpiLV6GTYf9V69nGT5pssGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                http://sonarr.vertras.xyzGet hashmaliciousUnknownBrowse
                  file.exeGet hashmaliciousUnknownBrowse
                    http://ct.ke/STUDENTS-FREE-LAPT0PSGet hashmaliciousUnknownBrowse
                      18.239.69.89https://www.myprepaidcenter.comGet hashmaliciousUnknownBrowse
                        18.164.96.2Clear-EasyPrint.b7002.ntclear.top.SK008.ch.exeGet hashmaliciousUnknownBrowse
                          172.64.41.3ZXQ3AcEN5Q.exeGet hashmaliciousUnknownBrowse
                            0af4a52e.0cce76886785b0ff1283f346.workers.devemailantonio.cataneo@axactor.com.msgGet hashmaliciousHTMLPhisherBrowse
                              file.exeGet hashmaliciousFormBookBrowse
                                LametaSetup.exeGet hashmaliciousUnknownBrowse
                                  file.exeGet hashmaliciousFormBookBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      file.exeGet hashmaliciousUnknownBrowse
                                        SmartConvertPDF_48187981.msiGet hashmaliciousUnknownBrowse
                                          file.exeGet hashmaliciousUnknownBrowse
                                            file.exeGet hashmaliciousUnknownBrowse

                                              Domains

                                              ⊘No context

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              AMAZON-02UShttps://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                              • 13.32.145.9
                                              f_0002b5.exeGet hashmaliciousUnknownBrowse
                                              • 18.245.86.79
                                              http://www.cpcheckme.comGet hashmaliciousUnknownBrowse
                                              • 52.49.232.14
                                              2T6MGxlKZT.exeGet hashmaliciousSmokeLoaderBrowse
                                              • 54.255.136.181
                                              EST- 250424-0370pdf.exeGet hashmaliciousFormBookBrowse
                                              • 3.64.163.50
                                              f_0002b5.exeGet hashmaliciousUnknownBrowse
                                              • 13.225.10.37
                                              https://mev-web.ca/?f=QeYBR2wfYK3JYIrbEQZr1C%2bgf3gU%2fmUvL9ovUEhJVZnxPIANQz6rboUW4U4PnItNOSuc98KvirQj3pwhsBFRc8hSk5YuKckp9PXbo9m%2baI9y9BiUYstagDwEu3371ebTwoTckHFX6OqMDkbqHH4mz6uY9e9M%2f9uY9zyYLM%2f9CmDvFT2uK2iCdJwzdbXIyiq2%2b9ClzMjyENFwui3qHuWODETmn%2b6yk0qQuV9sQ%2fGi6URseZjJRDXWcmWLNhvjc38WMu6H6e6u2IwMZcnl78FMfEZPvqt9omZdBVKeliCJX88SZ7m5zXYeBaIXu8XXIgDTSHNQrcMQ6iWL3ktNU9KNVy2%2fbL15XB8sLGGe1uVAbQ9hwGnOnoH4sBJOe3%2fpYYneZARrLcwphZSIduyqT3At%2f6Bzn57i7UC9z7ZDalFnOM1dZy5wNqsV62py1LJecHSNYxeFwHwj8D54XILdKl0BfW7sHpba1eyZjI%2bO8%2bGRE69nPLRa%2ffTy6B9wpFibF3RTGet hashmaliciousUnknownBrowse
                                              • 13.224.189.54
                                              https://cs-server-s2s.yellowblue.io/sync-iframeGet hashmaliciousUnknownBrowse
                                              • 54.195.106.144
                                              https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGnGet hashmaliciousUnknownBrowse
                                              • 18.245.253.27
                                              https://rstgmbh-rstsrl.start.pageGet hashmaliciousHTMLPhisherBrowse
                                              • 52.217.97.172
                                              CLOUDFLARENETUShttps://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154faGet hashmaliciousUnknownBrowse
                                              • 188.114.96.3
                                              https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                              • 104.17.2.184
                                              http://www.cpcheckme.comGet hashmaliciousUnknownBrowse
                                              • 104.17.25.14
                                              ZXQ3AcEN5Q.exeGet hashmaliciousUnknownBrowse
                                              • 172.64.41.3
                                              https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                              • 104.17.25.14
                                              https://forfbidrecrossboot.pages.dev/503.jsGet hashmaliciousUnknownBrowse
                                              • 188.114.96.3
                                              ZXQ3AcEN5Q.exeGet hashmaliciousUnknownBrowse
                                              • 104.21.45.251
                                              https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphta%3A%2Fvtslekssiaipcr.te%2Ftoenscino-x-pk%2F6tRunvbhyfphp.x&s=qPX4ToIpiLV6GTYf9V69nGT5pssGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                              • 104.17.2.184
                                              2T6MGxlKZT.exeGet hashmaliciousSmokeLoaderBrowse
                                              • 104.21.76.57
                                              SOA_41457.exeGet hashmaliciousAgentTeslaBrowse
                                              • 172.67.74.152
                                              MIT-GATEWAYSUShttp://www.cpcheckme.comGet hashmaliciousUnknownBrowse
                                              • 18.66.147.95
                                              2T6MGxlKZT.exeGet hashmaliciousSmokeLoaderBrowse
                                              • 18.66.102.80
                                              https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGnGet hashmaliciousUnknownBrowse
                                              • 18.172.112.40
                                              https://internal--alert-teamapp-site.ipns.dweb.link/#YW1hbmRhLm1vcnJpc29uQG9uZWFtZXJpY2EuY29tGet hashmaliciousHTMLPhisherBrowse
                                              • 18.66.122.44
                                              https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVrGet hashmaliciousUnknownBrowse
                                              • 18.116.9.206
                                              https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVrGet hashmaliciousUnknownBrowse
                                              • 18.116.9.206
                                              qwmLv2FcgD.elfGet hashmaliciousUnknownBrowse
                                              • 18.165.26.216
                                              http://sallywilliamson.com/Get hashmaliciousUnknownBrowse
                                              • 18.173.205.56
                                              http://bt-103301.weeblysite.com/Get hashmaliciousUnknownBrowse
                                              • 18.172.103.101
                                              http://phantym-wallett.weebly.com/Get hashmaliciousUnknownBrowse
                                              • 18.172.103.101
                                              AMAZON-02UShttps://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                              • 13.32.145.9
                                              f_0002b5.exeGet hashmaliciousUnknownBrowse
                                              • 18.245.86.79
                                              http://www.cpcheckme.comGet hashmaliciousUnknownBrowse
                                              • 52.49.232.14
                                              2T6MGxlKZT.exeGet hashmaliciousSmokeLoaderBrowse
                                              • 54.255.136.181
                                              EST- 250424-0370pdf.exeGet hashmaliciousFormBookBrowse
                                              • 3.64.163.50
                                              f_0002b5.exeGet hashmaliciousUnknownBrowse
                                              • 13.225.10.37
                                              https://mev-web.ca/?f=QeYBR2wfYK3JYIrbEQZr1C%2bgf3gU%2fmUvL9ovUEhJVZnxPIANQz6rboUW4U4PnItNOSuc98KvirQj3pwhsBFRc8hSk5YuKckp9PXbo9m%2baI9y9BiUYstagDwEu3371ebTwoTckHFX6OqMDkbqHH4mz6uY9e9M%2f9uY9zyYLM%2f9CmDvFT2uK2iCdJwzdbXIyiq2%2b9ClzMjyENFwui3qHuWODETmn%2b6yk0qQuV9sQ%2fGi6URseZjJRDXWcmWLNhvjc38WMu6H6e6u2IwMZcnl78FMfEZPvqt9omZdBVKeliCJX88SZ7m5zXYeBaIXu8XXIgDTSHNQrcMQ6iWL3ktNU9KNVy2%2fbL15XB8sLGGe1uVAbQ9hwGnOnoH4sBJOe3%2fpYYneZARrLcwphZSIduyqT3At%2f6Bzn57i7UC9z7ZDalFnOM1dZy5wNqsV62py1LJecHSNYxeFwHwj8D54XILdKl0BfW7sHpba1eyZjI%2bO8%2bGRE69nPLRa%2ffTy6B9wpFibF3RTGet hashmaliciousUnknownBrowse
                                              • 13.224.189.54
                                              https://cs-server-s2s.yellowblue.io/sync-iframeGet hashmaliciousUnknownBrowse
                                              • 54.195.106.144
                                              https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGnGet hashmaliciousUnknownBrowse
                                              • 18.245.253.27
                                              https://rstgmbh-rstsrl.start.pageGet hashmaliciousHTMLPhisherBrowse
                                              • 52.217.97.172

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:7-zip archive data, version 0.4
                                              Category:dropped
                                              Size (bytes):87996149
                                              Entropy (8bit):7.999994042425019
                                              Encrypted:true
                                              SSDEEP:1572864:Cw+4FrwcXqGNfh5Tf7nzbh8LGu0fcnU1wwp42GpcdOJ8:qS7Xpf5r7nztmI/xccd5
                                              MD5:0B6FA19DB0B90FD9222867D893CA216B
                                              SHA1:F58F5E07126CD2B51170E537E0544D85C0D0E057
                                              SHA-256:E125ED3D1E0B34FFB9D4442092D614F26FB6CDBCC4194AA514285547F43CECAC
                                              SHA-512:F854FA5CB02358F9D9475582E8DA76B6BF20270B0C864C512196F65818E67019355111B4639A60A27D73E61E7180AC43F0319199DDA1B626D2D8D3E0F3C8470C
                                              Malicious:false
                                              Preview:7z..'....E._..>.....%.........'...L..]...Jxe7.E..o..wq..j..n8....r.....'iu2..S.....Q.:.o...cuq...)g.....NNu.S.C.m.y.w.;.p...K......M.#.~......f....[.~q...t.....s...O.....+`....$.-.u.....P..N [.x.............m]..[i..J6.&..W.....#`...}....^.W.q....J.h.4.W<...L.AX..h.......=.....hc..Q.Q{..4..!..{.,.Ga.E&'.....`.mG:...NX.v.V...6$..........)T...... '.We..D.H.=j...n.......8.H..W1.......%..H.-Y@(5..$7...Ooo...jC.2..OAo .{...........d.....AF..m...P....].%-....".d...S.9..P:.... ...\.1......c....,...[{...Ly...K.)*.e..W..h...a...`.....5........Q.nr.p......Tp../m.P=....W..GQ....;K..}...U.U....p.{.......>m.`..J.1$...&.k.U...C....I..2......4.j...2..l.d.u.....ASk...[.9..$.:..P..3.N.s.l..u.>k...%=...f...n..XLi.y36..._x..2....1.5.....DG...........EB+sS..W@..80.o......'Bn...{.W..t)\..j....S..A....|?..o{.9LX..V?...I..=...Zvx.c..LE.1Lg*...;......U.~...>..p.E.QJ.-.^..H.oc0...{p.~Rb..._.7.3pl....7,-.=....YIs.?.... ..y..9a...qq...h.7.G.Ue......+.%..G..he...+.Y..

                                              C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:7-zip archive data, version 0.4
                                              Category:dropped
                                              Size (bytes):8546514
                                              Entropy (8bit):7.999863978630942
                                              Encrypted:true
                                              SSDEEP:196608:r4vIi14vIiV39NUOBonl4G1Hm4Xey/z6ZpE/b/MBmKWK2:ru1uV39NUqwyGV+pE/IBm7
                                              MD5:7DC87223BDC45F03C7C41B8AFF75C6D4
                                              SHA1:BD653C6190EFF7F2679C575E4DCB7F6AC9562F69
                                              SHA-256:EB019BBECEB137AC5BB629E47F7521385340CEE30CBAC95C6E64E62AEED58045
                                              SHA-512:DD9DF6D5CAC4B4334DE38B02966138A8E0123C6011E6EFDE1A9E014D276358747FD9669B45899462DDB3687F1A48F07240194C16796E8D037E240599D940EC40
                                              Malicious:false
                                              Preview:7z..'..._..v.h......&.......<SG.....].4...]:7.U.....M..&....H..-..$w.=S.Fm.1.k,..\...v......&J.>......\....5...;5.......z.....k.".E......}........b..\..).B,.....nL%$>.R..]..`.....k.A@..Xc.y...q...........9.N7..1..+..+.'......BF.8q.n..F.<E...........0....kb<.^.MN?O...-#... .c...G.(L....~....Z..vu...6..........U..]...M...Tn...H2."u.......H...hy.3..E1.]Ty.q..J.>.....p</._m....rLp6K.Ps..._..qs\....p.>..........q..2m....Xs...B...~p./.*.>..c.B.9.M..<.S.-.+N....V.....,..N.x.=9.....t...2!..G..$..[F..sZ&.....ou<.*.~v..&z.KP?..... +.W..S.......FE a...E..g..(.R.|!.E....D.V[}...$Q....g....H...?c...PoE...|)..g.y.8B.....V...>..NmRY..^....(K.....=~J.....I..lQ..#....-.~..Oi.E..\p%.H.rs..b[Bc...sm.v.6.B..M..k.h.$....$.E8.t.......}...}NG...{&..s..eXY?....a...Y.|...)u....vwC.q8.._..D.....S...G.4"#W..5....[D7..T.u"..:Z.t.D.(..9@.O..Xr.."A...[A..rB.J......h.0....?.\.xU&..G..a..,.U4..>...C+1..f<.......F0z.l...=//;...Q/l:"..l...:.X.m..`533.N......y..&EK`....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\007b0d76-28a3-436d-b3ab-b5452dfa769d.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2689
                                              Entropy (8bit):5.358915880780663
                                              Encrypted:false
                                              SSDEEP:48:YMlL0vB643fLdUb4qH5z3JCYXylVotougJG5K+HB+ndxvp0+6vBzuSg2OwYoJ/dl:zlLC6YfJiB5+DototoK4B2+LvJp+poJ7
                                              MD5:A1C09D3971866443A49BD942CF483ABE
                                              SHA1:9CE2445921A00A0B3CA548EDD5FBD43E6E0ED42A
                                              SHA-256:8652A95F3A803A80893D6529E11AC1DE8F93DCACBD7D2DB5FBDD9FFF6CC8BB8B
                                              SHA-512:8BD8A5277FE2DE6031E8BAE141F990E8CC57F98EDB4E68BD3F5863BE40BCB6FBF0078955CEFCE4CB4FD4B7DAB2111AD709E67DE02A7A77FE7A4605D2D0767A5E
                                              Malicious:false
                                              Preview:{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledF-5"},"chrome_labs_activation_threshold":8,"chrome_labs_new_badge_dict":{"chrome-refresh-2023":-1,"tab-groups-save":-1},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.71639930410499e+12,"network":1.71639249124e+12,"ticks":7071192319.0,"uncertainty":10349469.0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"polic

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\7a286aef-89f8-44d8-89d0-a4cf9233363d.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2769
                                              Entropy (8bit):5.353495227099254
                                              Encrypted:false
                                              SSDEEP:48:YrglL0vB643fLdUb4qH5z3JCYXylVotougEG5KHHB+ndxvp0+6vBzuPeg2OMooJ7:PlLC6YfJiB5+DotoQoKnB2+LvJz+toJ7
                                              MD5:206F95716340629BE907CD3234896BBD
                                              SHA1:65945065B9F2BCF0E1B8F745E2957838129CACCA
                                              SHA-256:F5459430CDB90B9B7305BD6B01E1FEBD26477A7B3DD23250EC3BB54A62C2C7A1
                                              SHA-512:A8B2177B8E3D567FCC4A76E4C4D3EB7797EE100CCB8ADA38741DAA207181A1381FE429A22C341D69E86B1AC22A8C6E1E20A8129FBCB5CE02A1BF72B12FFEC6A5
                                              Malicious:false
                                              Preview:{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledF-5","shortcut_migration_version":"120.0.6099.199"},"chrome_labs_activation_threshold":8,"chrome_labs_new_badge_dict":{"chrome-refresh-2023":-1,"tab-groups-save":-1},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.71639930410499e+12,"network":1.71639249124e+12,"ticks":7071192319.0,"uncertainty":10349469.0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\BrowserMetrics\BrowserMetrics-664E2CBE-1D64.pma

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):4194304
                                              Entropy (8bit):0.49867565544918274
                                              Encrypted:false
                                              SSDEEP:6144:7Woi0LMNWavi8V+NmjVtRxA1Hl7fb2g70+98:cV/j7K0
                                              MD5:F10175B26E19C62459687B833F23F643
                                              SHA1:A58E2308F2190B9F5F2E7686B60F3D59BDDA2836
                                              SHA-256:F12A6B5EE038CE3AEA4BB53144CDC5B13E31BEF8128688C5AA547E06FB3D13AA
                                              SHA-512:1E5E30CC8538B90442385C5C5494AACEF95CE5EDD678CDE3DABB9E19B5173EA9F18F44CF0A48C066F634FCB0D6C78D5B5F3E50BA532488139E7E9B2AD584A228
                                              Malicious:false
                                              Preview:...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............120.0.6099.199-64-devel".en-GB*...Windows NT..10.0.190452(..x86_64..?.......".hcbnpw20,1...x86_64J........J?J....r...J?J........J?J..m#:^...YJ..;.....J?J....% ...J?J..)......J?J..RS.....J?J..:.Y....J?J...!.....J?P......................,..(.......StatisticsRecorderRWLock....Enabled..$.. .......NoPreReadMainDll....Enabled.............WebGPU......Enabled..<..8.......DefaultGpuDiskCacheSize.....max_cache_6M_20230913....4..0.......PrivacyBudgetClockSkewMetrics.......Enabled..4..0... ...MediaFoundationD3D11VideoCapture....Enabled..(..$.......ZstdContentEncoding.....Enabled..,..(.......CrashReportBreadcrumbs......Enabled..X..T...!...SidePanelCompanionDesktopM116Plus...&...CSC_

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad\settings.dat

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):40
                                              Entropy (8bit):3.1609640474436795
                                              Encrypted:false
                                              SSDEEP:3:FkX6+TNS8n:+tS8
                                              MD5:60E3E1B2D167F47A7BF062674AE5128F
                                              SHA1:60FBC0AE73D641736070B784614C1AF37E86FCB1
                                              SHA-256:CAA74712A253DBCE3B178D829A69B777470619D0B0E2D6938C60F1C990F50959
                                              SHA-512:BA2C59FB45F74D55F8A6548A91C27BCD9B16F7CFA29E1F50B3C72362F9FEAE4AE50D1B236986E410C86C8DE7CF26958582AF9A0DDD3FFBF2175993920F4D9816
                                              Malicious:false
                                              Preview:sdPC.....................V..4.{I......#.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\03a0ca70-78f0-41d9-9d1b-a5cb6e1cf5c2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\0f778b33-a4f4-4a85-acf8-e3163d1618ac.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):9140
                                              Entropy (8bit):5.248364900507016
                                              Encrypted:false
                                              SSDEEP:192:r6UarKtJQ16hPlV+Fp2xfEyf2pFIOLdR6yIsnVr:rhWyFNGpyz2pFIOH
                                              MD5:6DBC1F92CBDF326A54583A5E673D8E65
                                              SHA1:D9BCF478E9C4AB5A8FA5F5D11AC5016D3156E2EB
                                              SHA-256:9B2682F16818EA55219E4A0A17198FA64722A2E840B72CA7243DEB333D858511
                                              SHA-512:8F8C07F7726A7BE655DD219FE28EABE38211C5671B886B06BE97787727DDCDD44442F8117154110E9C42AC4288EF8D84205E16A3A900099A1DF58317C3D176A9
                                              Malicious:false
                                              Preview:{"account_tracker_service_last_update":"13360872896229903","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13360872895413359","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":120},"autofill":{"last_version_deduped":120},"browser":{"check_default_browser":false,"has_seen_welcome_page":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13360872895501743","countryid_at_install":17224,"default_apps_install_state":3,"default_search_provider":{"guid":"fdb04720-a531-475d-9308-f1decf03b346","keywords_use_extended_list":true},"dips_timer_last_update":"13360872901297224","domain_diversity":{"last_reporting_timestamp":"13360872896336083"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{"newtab":[{"active":true,"entry":"ch

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\4fe1725e-8251-473e-8e53-28c413df9cb6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\5f20f944-c4c6-40c1-8f7a-f50e224c4ec0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):10889
                                              Entropy (8bit):5.573238361036634
                                              Encrypted:false
                                              SSDEEP:192:hdQU2hEbA7Qs3QH1ehHx9wHlGBHLp9eLK8vDw2pFIOwY:nQKcPW20HlWF8LK8w2pFIOV
                                              MD5:DE2A89D1C7D43EFF5B819B76B6EA2A71
                                              SHA1:6DC823D0073D6B1615F17096FEB3CEA4CB61E87F
                                              SHA-256:15302C3D1C7FA26DAEC80856C6BEAA17D2B7F0D804CB925A892CA34B47CB81E0
                                              SHA-512:6545C443DE5409F6B8A17534F92830B39F1C36925ECBEFC9FFF97869CD6AE24CC9239D7ABED791807D92D49BE51F43F9773B005CB6C0412ED7CC1268B41BC516
                                              Malicious:false
                                              Preview:{"default_search_provider_data":{"template_url_data":{"alternate_urls":[],"contextual_search_url":"","created_by_policy":false,"created_from_play_api":false,"date_created":"13242866705662805","doodle_url":"","enforced_by_policy":false,"favicon_url":"","id":"10","image_search_branding_label":"","image_translate_source_language_param_key":"","image_translate_target_language_param_key":"","image_translate_url":"","image_url":"","image_url_post_params":"","input_encodings":[],"is_active":0,"keyword":"clear","last_modified":"13242866705662805","last_visited":"0","logo_url":"","new_tab_url":"https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713","originating_url":"","preconnect_to_search_url":false,"prefetch_likely_navigations":false,"prepopulate_id":0,"safe_for_autoreplace":false,"search_intent_params":[],"search_url_post_params":"","short_name":"Clear","side_image_search_param":"","side_search_param":"","starter_pack_id":0,"suggestions_url":"https://meta.c

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\71ccdf6c-cf14-42f4-98c9-965d60e94242.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):9015
                                              Entropy (8bit):5.25075063531429
                                              Encrypted:false
                                              SSDEEP:192:r6UarKtJQ16hPlV+FptxfEyf2pFIOjPR6yIsnVr:rhWyFNGp7z2pFIOV
                                              MD5:6F9939346A87B282547D7984E0EFBF9A
                                              SHA1:0C1C8C87453A57D89E698CDBF0650341D41695B5
                                              SHA-256:56E9DEDBE2FAF70F2894ADAA4D3DF171C1D69835CAEC301A5210906CFF27539F
                                              SHA-512:22DA74DE1DD587A2EDFB5A62DF76390F879340AE7EC58010334D2B863237C9A7967EDBE208D3955F5BD8700A6E4C2FC1E42E1D076AE836402D0CF360343EFC2D
                                              Malicious:false
                                              Preview:{"account_tracker_service_last_update":"13360872896229903","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13360872895413359","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":120},"autofill":{"last_version_deduped":120},"browser":{"check_default_browser":false,"has_seen_welcome_page":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13360872895501743","countryid_at_install":17224,"default_apps_install_state":3,"default_search_provider":{"guid":"fdb04720-a531-475d-9308-f1decf03b346","keywords_use_extended_list":true},"dips_timer_last_update":"13360872901297224","domain_diversity":{"last_reporting_timestamp":"13360872896336083"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{"newtab":[{"active":true,"entry":"ch

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\8d7f9856-6a31-4796-9001-d863b079b6f3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):414
                                              Entropy (8bit):5.05452913082206
                                              Encrypted:false
                                              SSDEEP:12:1HAgdRN64V+zW1+F6sKaxVRpNz7AYOjN6It:1H//+y1BxaxVRpNAYO3t
                                              MD5:A8414238AA105E4F93E556F24C7CE909
                                              SHA1:9481B38A070380FA76DB094EB3AE76BC1F920D51
                                              SHA-256:D96F931DEE3B3E26ADD23C8A8AB552CE0F51EA162EE8EED98E9D1A327A5B9917
                                              SHA-512:D8D1E5E88799D74AD4E075F7B84027F0E1A8D6E0FF71F419340A63B9ACD0A5ECB8CE4D00A3239F370569FF979B2977AD74BE5B9CCBB9AC9917DEEF23FFBD470F
                                              Malicious:false
                                              Preview:{.. "epochs": [ {.. "calculation_time": "13360872911538277",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "0AA5F3942F391451174473C01A227FEC96E59B5B6B59D06F955188296F652FE2",.. "next_scheduled_calculation_time": "13361477711538431"..}..

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\92621740-9ce4-414c-8639-9458514c3a01.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):38
                                              Entropy (8bit):4.023471592049354
                                              Encrypted:false
                                              SSDEEP:3:N0DIQVoKy:a8Q+
                                              MD5:3433CCF3E03FC35B634CD0627833B0AD
                                              SHA1:789A43382E88905D6EB739ADA3A8BA8C479EDE02
                                              SHA-256:F7D5893372EDAA08377CB270A99842A9C758B447B7B57C52A7B1158C0C202E6D
                                              SHA-512:21A29F0EF89FEC310701DCAD191EA4AB670EDC0FC161496F7542F707B5B9CE619EB8B709A52073052B0F705D657E03A45BE7560C80909E92AE7D5939CE688E9C
                                              Malicious:false
                                              Preview:..... 2a68348c2ca0c50ad315d43d90f5a986

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\99eb271e-e102-47bf-b51f-611a86084830.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:very short file (no magic)
                                              Category:dropped
                                              Size (bytes):1
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:3:L:L
                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                              Malicious:false
                                              Preview:.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Affiliation Database

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 5, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 5
                                              Category:dropped
                                              Size (bytes):45056
                                              Entropy (8bit):0.39999382381980225
                                              Encrypted:false
                                              SSDEEP:24:TLzxblvGgOg53yS0lNvN2HLvKroyr0n4BmhltoVOq6Uwcc05fBGQwQ:TnxiSdLS0aVOlU1coB
                                              MD5:86AC32A0DC2CDC49F2F7FEB3716DD690
                                              SHA1:715C9271E311F44F3FE6FF57D01491122D7E48ED
                                              SHA-256:225CE4988A97754064150B3762EC1570AD9DB0953B6C197BF8E1942E4FF1BDD2
                                              SHA-512:688E44FFF98C6F96B79764AD82678DFB16FE5E3510C05739ED1D0A734345A39D1BDB9924919C727001BCCEAE96BA9B215D56457865F65EBEE1A5E64082FC58DF
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g.....e...$.y.....Q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Bookmarks (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):3636
                                              Entropy (8bit):4.250941553397405
                                              Encrypted:false
                                              SSDEEP:96:NmrXtLqTXGeaTX0yULsxTXFgVGTXSfDEeMFX9Zlsp:/ECgCQu5eu
                                              MD5:AD7F5E9B2921D337AE27B8D19720F3F0
                                              SHA1:830463A0D9CBFA8488445D534163F10B0842E22D
                                              SHA-256:EA2BBFB654C3B6286A74684102CD7FB04E012477AFBBCBE46C3CB250B4918E6F
                                              SHA-512:3FC47E1D3E325D79C05B70A5B8A56E75FDF5866B843A74C9B5DD6D5F4499CB4FA5792F735E5427567D28245F4A210963012B823C22E78DF3EEBD9B3707E1DBE6
                                              Malicious:false
                                              Preview:{.. "checksum": "9f480330b31a3bd75d49b309d817947e",.. "roots": {.. "bookmark_bar": {.. "children": [ {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "44c9dbe7-3361-44ee-9442-ca46d90884b0",.. "id": "5",.. "name": "Amazon",.. "type": "url",.. "url": "http://www.amazon.com/".. }, {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "7b0cfb85-cb4c-41a1-b7dc-4f1f0ecc2a1f",.. "id": "6",.. "name": "Facebook",.. "type": "url",.. "url": "http://www.facebook.com/".. }, {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "b264426c-ca85-4ddd-b3d7-d440fd0079bc",.. "id": "7",.. "name": "Google",.. "type": "url",.. "url": "http://www.google.com/".. }, {..

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\BrowsingTopicsSiteData

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):28672
                                              Entropy (8bit):0.4377590389593228
                                              Encrypted:false
                                              SSDEEP:12:TLiqiy5B5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwT:TLiiB5byqkiXBzlRr6hkc6UwccI5fBG
                                              MD5:A3640DEE9443FEB6ACB411E74C44FB15
                                              SHA1:9D3EDAA5CADE0F596B194041EAD839ECC65615E7
                                              SHA-256:DE6CDCF170559CD30790B1B36A48F1366E98CFD54513C1099822377B0CB02AA2
                                              SHA-512:12BC8DDBC4E75EEE2877D710FFBC83ADA602D068F1C4EA6ECA69CB7E36905F8321AF5AD058631703B7CEC22358FFDF98261BBB88D42811F24C5BCAC0B17F674E
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g.......o..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\BrowsingTopicsState (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):414
                                              Entropy (8bit):5.05452913082206
                                              Encrypted:false
                                              SSDEEP:12:1HAgdRN64V+zW1+F6sKaxVRpNz7AYOjN6It:1H//+y1BxaxVRpNAYO3t
                                              MD5:A8414238AA105E4F93E556F24C7CE909
                                              SHA1:9481B38A070380FA76DB094EB3AE76BC1F920D51
                                              SHA-256:D96F931DEE3B3E26ADD23C8A8AB552CE0F51EA162EE8EED98E9D1A327A5B9917
                                              SHA-512:D8D1E5E88799D74AD4E075F7B84027F0E1A8D6E0FF71F419340A63B9ACD0A5ECB8CE4D00A3239F370569FF979B2977AD74BE5B9CCBB9AC9917DEEF23FFBD470F
                                              Malicious:false
                                              Preview:{.. "epochs": [ {.. "calculation_time": "13360872911538277",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "0AA5F3942F391451174473C01A227FEC96E59B5B6B59D06F955188296F652FE2",.. "next_scheduled_calculation_time": "13361477711538431"..}..

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0013048353003233331
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zEkl:/M/xT02zn
                                              MD5:A675EEC42D7B5101BAAE3FD440B2E082
                                              SHA1:9B15BF20F704502A8B13A22023A3CD986C29B510
                                              SHA-256:015B56A264EFE2F133E279550F254DAEF93553D545CFAE08DA681139BE54B9E8
                                              SHA-512:37D998AC04EBF6B11B402AB88B20832DF2A735FCFA452F75B039B1FCDF865B649A1FD8DA717E2280803B45976B47C2DFC7A9E840F2F1D3081821A1240E487DFC
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Cache\Cache_Data\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):524656
                                              Entropy (8bit):5.027445846313988E-4
                                              Encrypted:false
                                              SSDEEP:3:LsuliBh7t:Lsfbt
                                              MD5:ADC08C467721AFD278BBAA21631239F9
                                              SHA1:D9D1E4E71DDF8462E6160741E5D2F1AE5811ACD0
                                              SHA-256:5515026D8B11EE6510695367D166874D8DB710DF9EAB43BDC813D6BB90500E36
                                              SHA-512:8DF41784601B18825A6A7A99D532B405624AC32C9537009CCB1374DF129AE426638EBDA991EA04A5BD5AB93AB7842DD4630C706C4EA0A741D78150EA4A7350D7
                                              Malicious:false
                                              Preview:...........................................w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\js\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):2.1431558784658327
                                              Encrypted:false
                                              SSDEEP:3:m+l:m
                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                              Malicious:false
                                              Preview:0\r..m..................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\js\index-dir\temp-index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\wasm\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):2.1431558784658327
                                              Encrypted:false
                                              SSDEEP:3:m+l:m
                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                              Malicious:false
                                              Preview:0\r..m..................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\wasm\index-dir\temp-index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\webui_js\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):2.1431558784658327
                                              Encrypted:false
                                              SSDEEP:3:m+l:m
                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                              Malicious:false
                                              Preview:0\r..m..................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\webui_js\index-dir\temp-index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Code Cache\webui_js\index-dir\the-real-index (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.955557653394731
                                              Encrypted:false
                                              SSDEEP:3:f50XTESi+:h0wp+
                                              MD5:4A55FD37AF7390224445E3641BD080A1
                                              SHA1:37D399DB5B7D91DB754F7F78EEC38797C5BB9A29
                                              SHA-256:1FF1A5C30BD2CF64912E7115CD4CF7BB3529E450740C30576B8B0927754132DB
                                              SHA-512:5FC4C4F63B05919E4352580B2640A20461ABD5EA2EAB78D7A415945ACAE2891B9EDF697FBDC139EEF363BFD2838917A70D9DE856F2D3DFF4CD7BDBC4263F93D0
                                              Malicious:false
                                              Preview:(....r..oy retne...........................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DIPS

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):28672
                                              Entropy (8bit):0.44554894175952964
                                              Encrypted:false
                                              SSDEEP:24:TLizWQDFQq3qhmJz3WMYziciNW9WkZ96UwAfBI:Ti9Qq3qhmJz3bY2LNW9WMcUtB
                                              MD5:08029A3458B4BE6117DF7D69047B0F94
                                              SHA1:F3D83B8E88081D10B5D9E9C30974FA084937E9E7
                                              SHA-256:E9DB143389928F3574F08712529E0EC70B95EC8D567B3DF1A11F88ED83DA7555
                                              SHA-512:4454B3C615DA6DCB3644EEB6C012D1D879A36D56302B09DB5C81430075DA0B22D3AF6D8DC621D63E8636367E63FAB0D4FC8A74B1F8875B761038E6140E63FCF7
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DawnCache\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DawnCache\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0012471779557650352
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DawnCache\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DawnCache\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\DawnCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):262512
                                              Entropy (8bit):9.553120663130604E-4
                                              Encrypted:false
                                              SSDEEP:3:LsNlRSq:Ls30q
                                              MD5:69A2D97A80D9AB3A56513231F15D1ABB
                                              SHA1:B8F5C60DBEBCA2678B09C3D43CBD2FEE0EB0799C
                                              SHA-256:0D27D523724995BF45A501CC2B595FB083D778D27550535F6E73495E6FEA07AB
                                              SHA-512:5CEA99B16B0DA84B3F7DE97FC661F4FFC81DF00FB16D5A792564B2A41F5342149D0157A01B270505FCCC7694E50AFE0E9E223603CCFAFAE539DE7E393CC10DFF
                                              Malicious:false
                                              Preview:.........................................P.w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):190
                                              Entropy (8bit):1.8784775129881184
                                              Encrypted:false
                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCT
                                              MD5:BD4367115C311692E06B63F1793B0624
                                              SHA1:CD807FEF06588E7C56FDB1A3A2CE15EF04955A16
                                              SHA-256:46ED76C989FA492AF602D813EAF61C17EDD71251674807A443B8F9CCC988292A
                                              SHA-512:98E63595B75951B719868396E11CA9153B7B987DD9737E3DEC67E067C9A68AB706FE993BDB8DB86D664D7353D9DC7D742D10430DDD0FE5F0847C687FCB257E52
                                              Malicious:false
                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):285
                                              Entropy (8bit):5.169339876203229
                                              Encrypted:false
                                              SSDEEP:6:DsaydFUwb1cNwi23mrXgN8aVdg2KLlpsagqyq2PcNwi23mrXgN8aPrqIFUv:DE9ZmG0LrSvvLZmGL3FUv
                                              MD5:476F7219E2B19649E644C084CC856258
                                              SHA1:5ACD55BA237514DEEDB5A0E2228A5A743593F8FB
                                              SHA-256:4B7376B73C90ACFA12AB00EF3623EE81F0DF085D840E5C2DDAE89382BBC22549
                                              SHA-512:30BF3BCAB656098C58A8E2B867D95534FED89A58BF790E992829D20D0450B5E1BBC92E5294E46F87DE6FB39E3B3B61A6144353B4203D23062E211AF27727ED57
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.488 1dc0 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules since it was missing..2024/05/22-13:34:55.511 1dc0 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Rules\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):95
                                              Entropy (8bit):1.8784775129881184
                                              Encrypted:false
                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCT
                                              MD5:021B8D293C14358BB37B18BA45792AA5
                                              SHA1:22E73B3A1D152734191BF7DE9472A54BE346B706
                                              SHA-256:5B149D68659EBEAB90F1116B8704A32DC240FBF85171BD4A4F70D57A3D8D4BB8
                                              SHA-512:BA8ED4BE209DD74C7E76BBB3F9BC8CFD2965AE9BB927EF44AE7A30498C15F46065F1BED4E6EA544AD6732BC5E7BA71154C0B70E3BEFF8ECF459CD747038E3F65
                                              Malicious:false
                                              Preview:.f.5................f.5................f.5................f.5................f.5...............

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):289
                                              Entropy (8bit):5.186965034976091
                                              Encrypted:false
                                              SSDEEP:6:Dsa2R1cNwi23mrXgN86FB2KLlpsac4kQ+q2PcNwi23mrXgN865IFUv:DSZmG/FFLruvLZmG/WFUv
                                              MD5:124E73A8450504A97B6568DAB21BF00D
                                              SHA1:5936BEFD67D563FE66693D0BFB8D88961063B9D1
                                              SHA-256:92AC82AE519734AF4D141606E5AE695715874247443B0E02EEA54D04F7E652B7
                                              SHA-512:1EA2A4CF3DF9D979F3D5495A1CE1AEA1FF34E90DE775C1993276669F5C3841C81F128058F6BBFED31C61DE428FEA061C2FFAD32A287159294D3816F3F016635B
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.542 1df8 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts since it was missing..2024/05/22-13:34:55.688 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension Scripts\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):285
                                              Entropy (8bit):1.8784775129881184
                                              Encrypted:false
                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxf:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCT
                                              MD5:785C71B68BF89A0E9973E06D76434AB1
                                              SHA1:2EB96ED892A724F5F223FE37ABBD075D448D45E3
                                              SHA-256:FFF9C841AF450DFEFE7F284F645D4A26B048E6BD5709AD766B308172BC260A53
                                              SHA-512:A84D94A4B22D325A41B84C193A2E279BC3969085D87EDA3FAD0DC1032989BD26E67ABA7CEFA085838590E5AEF8958C40E22A000D158FD80782B614DCDBC55030
                                              Malicious:false
                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):285
                                              Entropy (8bit):5.209980530921931
                                              Encrypted:false
                                              SSDEEP:6:DsasoM1cNwi23mrXgN8Yg2KLlpsabcMq2PcNwi23mrXgN8NIFUv:Deo2ZmGqLrpcMvLZmGpFUv
                                              MD5:D03261AC74806B8630044567E58DD14C
                                              SHA1:B35E553937B774AF311CA8FFDAE2C3E2C7C21CAC
                                              SHA-256:FC46627FBB1573684A191E5428C757EF9FA8FD70CD94A431C10D66013C658AD8
                                              SHA-512:C22CEA35EFE8F8FE902568BB8D428B711C928FC299678425621F2E9B107C044D195A7C5E09D99AF56D76D6D0EACBBFCF20C41D214C4B4D7E55E9E1ED34223A7D
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.697 1894 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State since it was missing..2024/05/22-13:34:55.763 1894 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Extension State\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Favicons

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.6975083372685086
                                              Encrypted:false
                                              SSDEEP:24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
                                              MD5:F5BBD8449A9C3AB28AC2DE45E9059B01
                                              SHA1:C569D730853C33234AF2402E69C19E0C057EC165
                                              SHA-256:825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
                                              SHA-512:96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):295
                                              Entropy (8bit):5.249161830004906
                                              Encrypted:false
                                              SSDEEP:6:DsIoWhM1cNwi23mrXgNWT5g1Iu2KLlpsIoQxq2PcNwi23mrXgNWT5g1IdqIFUv:DyWh2ZmGg5gSiLry6vLZmGg5gSRFUv
                                              MD5:CD0B1856314E2223F58829A1AFC45F1F
                                              SHA1:11B0492AF28D172FD983A436C5DB845FBE731263
                                              SHA-256:72E35D7B98D9F886CFC6D04AC71786E2E6BF181E50E3A4ED5E4B03AC6DDF8046
                                              SHA-512:1435CA546E6A282F105DCF3889124AE62D9255AF448D5484B6FA54AADF4F8D9A1326BED98A2F3C046E1C2062447565F86214F8581A5D3E56D2A0D5FACF391D90
                                              Malicious:false
                                              Preview:2024/05/22-13:35:11.934 1b84 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption since it was missing..2024/05/22-13:35:11.956 1b84 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GCM Store\Encryption\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GPUCache\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GPUCache\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0012471779557650352
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GPUCache\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GPUCache\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\GPUCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):262512
                                              Entropy (8bit):9.448177365217996E-4
                                              Encrypted:false
                                              SSDEEP:3:LsNlL:Ls3L
                                              MD5:6951D4C2F8A084B382C4B4F2E23805C6
                                              SHA1:15AE5BD59954794233428280C7A5834185DC1151
                                              SHA-256:B483C7C201F342F9DE497F08AAC6FA239A98BADB79EA49170DA8CEADFF80D814
                                              SHA-512:5DD595D992C83403F603982F645872A08CAC0FCDA2B068D5BFB55EF3DB8810010BCAED0ABD509921615DDA7EFA1301DBDBEB451B8C10CF06D14322ADAA684435
                                              Malicious:false
                                              Preview:........................................5...w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Google Profile.ico (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Google Profile.ico~RF6bc645.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Google Profile.ico~RF6bda1b.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\History

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):163840
                                              Entropy (8bit):0.5399377230833513
                                              Encrypted:false
                                              SSDEEP:96:6pE/uejzH+bF+UIYysX0WxQnYEHt/DfLcLq2piRk/E0:6pE/tH+bF+UI3if+YWNkqp3
                                              MD5:B9D9AD5A6FFA8729220995E658FAE634
                                              SHA1:40310CA492CC47004E7A75ED4616A0020E65C01C
                                              SHA-256:BD896231F6DFFF599237F218D6D1905B3552F781BE557D678F2576204F9EC6BE
                                              SHA-512:10AE1A27F716AB78A03C0A3A3DA8D35986E2BD96181A6FF87B254B1B0CC01CF46D7AF2A3BB1E60AC224A835CFD2C40B25F57F025C4A626CBB130DC39B048BB7A
                                              Malicious:true
                                              Preview:SQLite format 3......@ .......(...........!......................................................n.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):297
                                              Entropy (8bit):5.202029073496801
                                              Encrypted:false
                                              SSDEEP:6:DsaTVutq1cNwi23mrXgN8a2jM8B2KLlpsaT/39+q2PcNwi23mrXgN8a2jMGIFUv:DLutcZmG8jFLrlIvLZmG8EFUv
                                              MD5:3165E3EB5FD38001D4D2DFA1BCE1ED7F
                                              SHA1:EB75CC8329863C1EAA16F2D05ACC418BC2FDD9A9
                                              SHA-256:AF4CDEF2CA4E631B56D1C85DE0F3A9CEF6F0DED576DA9AC579124A68F81025E2
                                              SHA-512:3DDD6C8E7C605BCA322EB676A57E614025BCAABF4F868C5127FC03A4AFACFF69BD389CB406FB584CA8421BCF2685D6FA0653ECF4F200D73FCFDBCD6633E2ED3B
                                              Malicious:false
                                              Preview:2024/05/22-13:34:56.682 1e88 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb since it was missing..2024/05/22-13:34:56.743 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Local Storage\leveldb\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Login Data

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):40960
                                              Entropy (8bit):0.862070382350486
                                              Encrypted:false
                                              SSDEEP:96:QLSQCn8MouB6w9f/8iZqmvJKLPeymwil:QLSQG7Iw9fEiSi
                                              MD5:6415415E5C1F0EA8F3E7F575D6F1F44D
                                              SHA1:F8FB508830EDEE9DF8D329AAC47901505018C0CC
                                              SHA-256:360534256C32110318D6D4D3045368B21833279A19007C5EF3E3DD5C6D801A24
                                              SHA-512:F2B0390D8E9D88F6CCD1E4D2CF84A1AF8C1C2EC1E40E8ECAFC3E69DEA2E4EE39FCF5A32BF236CD3474EB053B83AD09ABDF375D5B5C095C16274AC3D4AE552D8C
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Login Data For Account

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):40960
                                              Entropy (8bit):0.862070382350486
                                              Encrypted:false
                                              SSDEEP:96:QLSQCn8MouB6w9f/8iZqmvJKLPeymwil:QLSQG7Iw9fEiSi
                                              MD5:6415415E5C1F0EA8F3E7F575D6F1F44D
                                              SHA1:F8FB508830EDEE9DF8D329AAC47901505018C0CC
                                              SHA-256:360534256C32110318D6D4D3045368B21833279A19007C5EF3E3DD5C6D801A24
                                              SHA-512:F2B0390D8E9D88F6CCD1E4D2CF84A1AF8C1C2EC1E40E8ECAFC3E69DEA2E4EE39FCF5A32BF236CD3474EB053B83AD09ABDF375D5B5C095C16274AC3D4AE552D8C
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network Action Predictor

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                              Category:dropped
                                              Size (bytes):45056
                                              Entropy (8bit):0.40279553249119593
                                              Encrypted:false
                                              SSDEEP:24:TLVbiTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:TJio9n+8dv/qALihje9kqL42WOT/9F
                                              MD5:86FF67B751C3CA40007346496EC7E3AD
                                              SHA1:D0EF0DFCFB4621EE16D3630ADF07527F0073900E
                                              SHA-256:DE497118971AB48EB1F3230A6ABC648D3F81BE6C730207C3A756905D3D235474
                                              SHA-512:41F3F72607EC8A4F7620AD3C6D0D0B1D09D37B2D2EAC4BCEE29CBE65192E8653D3F108FFE17D703DBB93CDB7C3D0511064A00D50573D148B35356D8592EB542C
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\44eb9690-80f3-4918-b2f8-baac9da64af3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1055
                                              Entropy (8bit):5.36197557847782
                                              Encrypted:false
                                              SSDEEP:24:YXs1JZVM8esOZOiHwSMs2ZloToAHcV29OxdkYhbSpDa7n7:YXsBzesK/MsC0oh2pYhbyD0
                                              MD5:41B0D4CD0D116CC85BA15EB62945BA6A
                                              SHA1:161045D7517AEEA7E01FC39978380AF0BD3E8E66
                                              SHA-256:DB0BFE679DE58AEA6F0BD5CA6315FFCA64B0D8AC7EB6E79ACB6BE406114AF667
                                              SHA-512:9085F2FDBBE60F179A9E3034A674B8A592D9DEA68CA2E2243AD265EBC6D327F09FE9ED26C8641A74F911A3C21EADE1353474B72264804036388AFEBA27059C3A
                                              Malicious:false
                                              Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13363464898034142","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://accounts.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13363464898784961","port":443,"protocol_str":"quic"}],"anonymization":["KAAAACIAAABodHRwczovL3Bob3NwaG9yLXBhLmdvb2dsZWFwaXMuY29tAAA=",false],"server":"https://phosphor-pa.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13363464906550214","port":443,"protocol_str":"quic"}],"anonymization":["MAAAACsAAABodHRwczovL29wdGltaXphdGlvbmd1aWRlLXBhLmdvb2dsZWFwaXMuY29tAA==",false],"server":"https://optimizationguide-pa.googleapis.com"},{"anonymization":["GAAAABQAAABodHRwczovL2NsZWFyYmFyLmFwcA==",false],"server":"https://cloudfront.clearbar.app","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version"

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\4cfa74cc-b63e-4bbc-bc5e-c9ea2bcd683e.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):59
                                              Entropy (8bit):4.619434150836742
                                              Encrypted:false
                                              SSDEEP:3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
                                              MD5:78BFCECB05ED1904EDCE3B60CB5C7E62
                                              SHA1:BF77A7461DE9D41D12AA88FBA056BA758793D9CE
                                              SHA-256:C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
                                              SHA-512:2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
                                              Malicious:false
                                              Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\4ecb2bb4-8da8-40e0-84e0-032bc1d329f1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2
                                              Entropy (8bit):1.0
                                              Encrypted:false
                                              SSDEEP:3:H:H
                                              MD5:D751713988987E9331980363E24189CE
                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                              Malicious:false
                                              Preview:[]

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\Cookies

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.5710061205109841
                                              Encrypted:false
                                              SSDEEP:12:TLVAMFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9J08h:TLrF1kwNbXYFpFNYcw+6UwcQV5fB
                                              MD5:F2056B5AF2E9A931C2D6DB1FE03B9927
                                              SHA1:9498E91920D43BA62891E30CC679AFD7712839B6
                                              SHA-256:38C391BCCA1020F619ADB7DDF0A452A9679FAD168B37455005CFAE165D85DC2D
                                              SHA-512:222AF12C8858437C0DF5333FD3E2566A1BAC6F87CB5F1FE40B3A4D31284ED31FE2394623286D0103D9468315A277B90EA5CCBEBD7D178F74B130282A2ED2CCD6
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\Network Persistent State (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):59
                                              Entropy (8bit):4.619434150836742
                                              Encrypted:false
                                              SSDEEP:3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
                                              MD5:78BFCECB05ED1904EDCE3B60CB5C7E62
                                              SHA1:BF77A7461DE9D41D12AA88FBA056BA758793D9CE
                                              SHA-256:C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
                                              SHA-512:2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
                                              Malicious:false
                                              Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\Network Persistent State~RF6c16c6.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):59
                                              Entropy (8bit):4.619434150836742
                                              Encrypted:false
                                              SSDEEP:3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
                                              MD5:78BFCECB05ED1904EDCE3B60CB5C7E62
                                              SHA1:BF77A7461DE9D41D12AA88FBA056BA758793D9CE
                                              SHA-256:C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
                                              SHA-512:2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
                                              Malicious:false
                                              Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\Reporting and NEL

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                              Category:dropped
                                              Size (bytes):36864
                                              Entropy (8bit):0.5557498376642536
                                              Encrypted:false
                                              SSDEEP:48:TgIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:8IEumQv8m1ccnvS6
                                              MD5:128B8ACD343585F3EC861F0E3368FDB1
                                              SHA1:605FEF03923ECD4162C0CE2A4C8D8D8F74E7FECC
                                              SHA-256:61E482E660E55BAED0302B8010727EDC1CCCFEE6522F40B411157FF902539A27
                                              SHA-512:DFE81EA549638BEC4ECF91D4286C3D2DC3D02DF31EB8DD6470D14F75B876BA1BC9C168B136CB142061B60AE5B86DA3BEEC5B33A690C2F82AF891FCAA457C4A5B
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2
                                              Entropy (8bit):1.0
                                              Encrypted:false
                                              SSDEEP:3:H:H
                                              MD5:D751713988987E9331980363E24189CE
                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                              Malicious:false
                                              Preview:[]

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\SCT Auditing Pending Reports~RF6bc80a.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2
                                              Entropy (8bit):1.0
                                              Encrypted:false
                                              SSDEEP:3:H:H
                                              MD5:D751713988987E9331980363E24189CE
                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                              Malicious:false
                                              Preview:[]

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\Trust Tokens

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                              Category:dropped
                                              Size (bytes):36864
                                              Entropy (8bit):0.36497034366287057
                                              Encrypted:false
                                              SSDEEP:24:TLF3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Th31DtX5nDOvyKDhU1cSB
                                              MD5:7CD8862624E6351A668A8EB081771936
                                              SHA1:52954F29C41D097829692A34FD7DBE0D19817AD2
                                              SHA-256:392896D3B54A13CD2C53DA93C3C798C2434A02ADDD5AB916F156D2FB196E689F
                                              SHA-512:FE2E5F59B46AE25F1D5F88A87EC4A0C12FA46ECAF3C4805B6B4ABB195594B7AE70C919490F684BD711330C8643C9160688BFA9DDBD44EE1592FE63212E2AB0AD
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Network\b1cbbbae-fc24-415c-b6b8-afda2a25d13e.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2
                                              Entropy (8bit):1.0
                                              Encrypted:false
                                              SSDEEP:3:H:H
                                              MD5:D751713988987E9331980363E24189CE
                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                              Malicious:false
                                              Preview:[]

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Preferences

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (417), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):10526
                                              Entropy (8bit):4.9778540125521795
                                              Encrypted:false
                                              SSDEEP:192:A5SdWGr89s3IBlO+Mx6FMLpJrR2A/pLhAz:DUqcs4BlO+MsFMFJrd/pLhAz
                                              MD5:5201918FB550D653FE2DDD6DCD2EF67F
                                              SHA1:594C1DEB883B0CA13A741FF1534687644D7F9DB2
                                              SHA-256:7E14786A6E89C2F7C5AE14BAE9A8913E01630981CF4185B336DCE27F44663EFA
                                              SHA-512:7B3A0CB8C99A7DAC9E1574CF7C8F1757790166D307F403CEDF72ED1758C6BFF6236E73DE4D425300E1B4B1518D7B4E1B5EE897F07105B2D9F200A88A30F89E4C
                                              Malicious:false
                                              Preview:{.. "browser": {.. "check_default_browser": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [ ],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",.. "doodle_url": "",.. "favicon_url": "",.. "id": "8",.. "image_url": "",.. "image_url_post_params": "",.. "input_encodings": [ ],.. "keyword": "clear",.. "last_modified": "13242866705662805",.. "last_visited": "0",.. "logo_url": "",.. "new_tab_url": "https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713",.. "originating_url": "",.. "prepopulate_id": 0,.. "safe_for_autoreplace": false,.. "search_url_post_params": "",.. "short_name": "Clear",.. "suggestions_url": "https://meta.clearbar.app/sug/

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Preferences~RF6bea86.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (417), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):10526
                                              Entropy (8bit):4.9778540125521795
                                              Encrypted:false
                                              SSDEEP:192:A5SdWGr89s3IBlO+Mx6FMLpJrR2A/pLhAz:DUqcs4BlO+MsFMFJrd/pLhAz
                                              MD5:5201918FB550D653FE2DDD6DCD2EF67F
                                              SHA1:594C1DEB883B0CA13A741FF1534687644D7F9DB2
                                              SHA-256:7E14786A6E89C2F7C5AE14BAE9A8913E01630981CF4185B336DCE27F44663EFA
                                              SHA-512:7B3A0CB8C99A7DAC9E1574CF7C8F1757790166D307F403CEDF72ED1758C6BFF6236E73DE4D425300E1B4B1518D7B4E1B5EE897F07105B2D9F200A88A30F89E4C
                                              Malicious:false
                                              Preview:{.. "browser": {.. "check_default_browser": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [ ],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",.. "doodle_url": "",.. "favicon_url": "",.. "id": "8",.. "image_url": "",.. "image_url_post_params": "",.. "input_encodings": [ ],.. "keyword": "clear",.. "last_modified": "13242866705662805",.. "last_visited": "0",.. "logo_url": "",.. "new_tab_url": "https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713",.. "originating_url": "",.. "prepopulate_id": 0,.. "safe_for_autoreplace": false,.. "search_url_post_params": "",.. "short_name": "Clear",.. "suggestions_url": "https://meta.clearbar.app/sug/

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Preferences~RF6c1196.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (417), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):10526
                                              Entropy (8bit):4.9778540125521795
                                              Encrypted:false
                                              SSDEEP:192:A5SdWGr89s3IBlO+Mx6FMLpJrR2A/pLhAz:DUqcs4BlO+MsFMFJrd/pLhAz
                                              MD5:5201918FB550D653FE2DDD6DCD2EF67F
                                              SHA1:594C1DEB883B0CA13A741FF1534687644D7F9DB2
                                              SHA-256:7E14786A6E89C2F7C5AE14BAE9A8913E01630981CF4185B336DCE27F44663EFA
                                              SHA-512:7B3A0CB8C99A7DAC9E1574CF7C8F1757790166D307F403CEDF72ED1758C6BFF6236E73DE4D425300E1B4B1518D7B4E1B5EE897F07105B2D9F200A88A30F89E4C
                                              Malicious:false
                                              Preview:{.. "browser": {.. "check_default_browser": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [ ],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",.. "doodle_url": "",.. "favicon_url": "",.. "id": "8",.. "image_url": "",.. "image_url_post_params": "",.. "input_encodings": [ ],.. "keyword": "clear",.. "last_modified": "13242866705662805",.. "last_visited": "0",.. "logo_url": "",.. "new_tab_url": "https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713",.. "originating_url": "",.. "prepopulate_id": 0,.. "safe_for_autoreplace": false,.. "search_url_post_params": "",.. "short_name": "Clear",.. "suggestions_url": "https://meta.clearbar.app/sug/

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Preferences~RF6c1697.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (417), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):10526
                                              Entropy (8bit):4.9778540125521795
                                              Encrypted:false
                                              SSDEEP:192:A5SdWGr89s3IBlO+Mx6FMLpJrR2A/pLhAz:DUqcs4BlO+MsFMFJrd/pLhAz
                                              MD5:5201918FB550D653FE2DDD6DCD2EF67F
                                              SHA1:594C1DEB883B0CA13A741FF1534687644D7F9DB2
                                              SHA-256:7E14786A6E89C2F7C5AE14BAE9A8913E01630981CF4185B336DCE27F44663EFA
                                              SHA-512:7B3A0CB8C99A7DAC9E1574CF7C8F1757790166D307F403CEDF72ED1758C6BFF6236E73DE4D425300E1B4B1518D7B4E1B5EE897F07105B2D9F200A88A30F89E4C
                                              Malicious:false
                                              Preview:{.. "browser": {.. "check_default_browser": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [ ],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",.. "doodle_url": "",.. "favicon_url": "",.. "id": "8",.. "image_url": "",.. "image_url_post_params": "",.. "input_encodings": [ ],.. "keyword": "clear",.. "last_modified": "13242866705662805",.. "last_visited": "0",.. "logo_url": "",.. "new_tab_url": "https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713",.. "originating_url": "",.. "prepopulate_id": 0,.. "safe_for_autoreplace": false,.. "search_url_post_params": "",.. "short_name": "Clear",.. "suggestions_url": "https://meta.clearbar.app/sug/

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\PreferredApps

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):33
                                              Entropy (8bit):4.051821770808046
                                              Encrypted:false
                                              SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                              MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                              SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                              SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                              SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                              Malicious:false
                                              Preview:{"preferred_apps":[],"version":1}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Secure Preferences (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):10889
                                              Entropy (8bit):5.573238361036634
                                              Encrypted:false
                                              SSDEEP:192:hdQU2hEbA7Qs3QH1ehHx9wHlGBHLp9eLK8vDw2pFIOwY:nQKcPW20HlWF8LK8w2pFIOV
                                              MD5:DE2A89D1C7D43EFF5B819B76B6EA2A71
                                              SHA1:6DC823D0073D6B1615F17096FEB3CEA4CB61E87F
                                              SHA-256:15302C3D1C7FA26DAEC80856C6BEAA17D2B7F0D804CB925A892CA34B47CB81E0
                                              SHA-512:6545C443DE5409F6B8A17534F92830B39F1C36925ECBEFC9FFF97869CD6AE24CC9239D7ABED791807D92D49BE51F43F9773B005CB6C0412ED7CC1268B41BC516
                                              Malicious:false
                                              Preview:{"default_search_provider_data":{"template_url_data":{"alternate_urls":[],"contextual_search_url":"","created_by_policy":false,"created_from_play_api":false,"date_created":"13242866705662805","doodle_url":"","enforced_by_policy":false,"favicon_url":"","id":"10","image_search_branding_label":"","image_translate_source_language_param_key":"","image_translate_target_language_param_key":"","image_translate_url":"","image_url":"","image_url_post_params":"","input_encodings":[],"is_active":0,"keyword":"clear","last_modified":"13242866705662805","last_visited":"0","logo_url":"","new_tab_url":"https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713","originating_url":"","preconnect_to_search_url":false,"prefetch_likely_navigations":false,"prepopulate_id":0,"safe_for_autoreplace":false,"search_intent_params":[],"search_url_post_params":"","short_name":"Clear","side_image_search_param":"","side_search_param":"","starter_pack_id":0,"suggestions_url":"https://meta.c

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Secure Preferences~RF6c1669.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):10889
                                              Entropy (8bit):5.573238361036634
                                              Encrypted:false
                                              SSDEEP:192:hdQU2hEbA7Qs3QH1ehHx9wHlGBHLp9eLK8vDw2pFIOwY:nQKcPW20HlWF8LK8w2pFIOV
                                              MD5:DE2A89D1C7D43EFF5B819B76B6EA2A71
                                              SHA1:6DC823D0073D6B1615F17096FEB3CEA4CB61E87F
                                              SHA-256:15302C3D1C7FA26DAEC80856C6BEAA17D2B7F0D804CB925A892CA34B47CB81E0
                                              SHA-512:6545C443DE5409F6B8A17534F92830B39F1C36925ECBEFC9FFF97869CD6AE24CC9239D7ABED791807D92D49BE51F43F9773B005CB6C0412ED7CC1268B41BC516
                                              Malicious:false
                                              Preview:{"default_search_provider_data":{"template_url_data":{"alternate_urls":[],"contextual_search_url":"","created_by_policy":false,"created_from_play_api":false,"date_created":"13242866705662805","doodle_url":"","enforced_by_policy":false,"favicon_url":"","id":"10","image_search_branding_label":"","image_translate_source_language_param_key":"","image_translate_target_language_param_key":"","image_translate_url":"","image_url":"","image_url_post_params":"","input_encodings":[],"is_active":0,"keyword":"clear","last_modified":"13242866705662805","last_visited":"0","logo_url":"","new_tab_url":"https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713","originating_url":"","preconnect_to_search_url":false,"prefetch_likely_navigations":false,"prepopulate_id":0,"safe_for_autoreplace":false,"search_intent_params":[],"search_url_post_params":"","short_name":"Clear","side_image_search_param":"","side_search_param":"","starter_pack_id":0,"suggestions_url":"https://meta.c

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):4538
                                              Entropy (8bit):6.033669368499709
                                              Encrypted:false
                                              SSDEEP:96:F1mKMWonO0ZDi0APHlcvtzTpbvtoJLKPFGcWWbiQKNLyM:F138pZu04FcvtJbvtaQtWWbiQsLJ
                                              MD5:6FCEF50F2A58C8727203B28A5B22D4A7
                                              SHA1:B61C363DF1F63BCCF167512109E2D4DACDA9D2C8
                                              SHA-256:52F7CE5332BA6329D66762C7290CBA49AA57D553E9E79D3B84D13E657515FD6F
                                              SHA-512:F522315C20269BD28CDE33F4CF9538D5236B6789680368C8ABCC83D7A4E7C4A9C29252EEF21991731DFCC94155F477D162C7447DF5CB21ACB4163B4B0788EC74
                                              Malicious:false
                                              Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2=..F2................URES:2...INITDATA_NEXT_RESOURCE_ID.3;..@.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.KINITDATA_UNIQUE_ORIGIN:chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/..:REG:chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/.0.....4chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/.=chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/worker.js .(.0.8.......@..Z.b.....trueh.h..h..h..h..h..h..p.x..............................REGID_TO_ORIGIN:04chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/..RES:0.1.....>chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/lib/ext.js..."@985D3FF5EB1C67946A3611A2ED7AAE526A30ACE699AD472A0B1FC33A2626C7E6..URES:1..PRES:1..RES:0.2.....Achrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/lib/native.js..."@9338DD136D2D9BC4AEFFBACB79D3FC7614E95A8F9B824D01B76BE6D215C3AE1F..U

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):301
                                              Entropy (8bit):5.134537262328368
                                              Encrypted:false
                                              SSDEEP:6:Ds/WDFUQM1cNwi23mrXgNE/a252KLlps/WuVq2PcNwi23mrXgNE/a2ZIFUv:DvDv2ZmG8xLrvKvLZmG8J2FUv
                                              MD5:4FDCA7C9CE23F94D4FB70392033B2AA1
                                              SHA1:BA3AEDE0157A20F43CE3A5197568DED62CAE74F7
                                              SHA-256:B05C6EF542DD3AFC479E65829731E8652C6FD7D3233EB4CB85BC36BE0474F33D
                                              SHA-512:9DC15547BB24AAC9D6694F92F44C1DD6EDD268224C06E7F83A1475BFD0FE78C57E40CE1D13CF86B4EF23D5E8B683D852AC5289D32715A12F1833ABF39053AD86
                                              Malicious:false
                                              Preview:2024/05/22-13:35:12.326 1064 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database since it was missing..2024/05/22-13:35:12.341 1064 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\Database\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\013888a1cda32b90_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):3128
                                              Entropy (8bit):4.196424795557409
                                              Encrypted:false
                                              SSDEEP:48:mcwMvgDo5fhmAA1SLf0CgQduDFuD5sYC0fHSgs/Jk:mDMID2pp10CgrDMDlCK
                                              MD5:78772D8D990F5672CA4E3CBF4D1B10AC
                                              SHA1:08F6AB368FD6C023C35E5779D8907A65AB282ECE
                                              SHA-256:E8CF21B0BC40400678BC2CBC74B249AB3B02173CC717D1C55DBE7C0C370D26B6
                                              SHA-512:A685AFE9738D550339DE9C8787309187D05615B024E0541E3875AC62E654544C2E6589B7A68EFC3F3474B534F1CA38E110CBD2CB7117DDF28DA054A8C5A26495
                                              Malicious:false
                                              Preview:0\r..m..........Hf.E....7async function getCurrentHistory(full = false) {. const list = [];. const tabs = await chrome.tabs.query({});. if (tabs && Array.isArray(tabs) && tabs.length > 0) {. tabs.forEach(item => {. let item_url;. if (item.url) item_url = new URL(item.url);. if (. item_url &&. (item_url.protocol == "http:" ||. item_url.protocol == "https:") &&. item.title !== "". ) {. list.push({. url: item.url,. type: "tab",. title: item.title,. favicon: `https://www.google.com/s2/favicons?domain=${item.url}`,. data: item,. });. }. });. }.. let historyCount = full ? 50 : 5;. const history = await chrome.history.search({. maxResults: historyCount,. text: "",. });. if (history && Array.isArray(his

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\013888a1cda32b90_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):3417
                                              Entropy (8bit):5.814621959306792
                                              Encrypted:false
                                              SSDEEP:96:XUaIMmPDWw3AHvOlWGWhwRwfzblb+rQpX9pQ4YOu9:XBbo6eAHvOlUWmn9+8pH5s
                                              MD5:3FDBE7FE6F6FE5DB60E73BF18B2FBD91
                                              SHA1:DC55D1FF161E70D8343A758B72CB3039AB05677D
                                              SHA-256:CB36DB98088F14551D1B79A2CF1E1F1B74A2DFC7F521158B3B83E8F352D02AAC
                                              SHA-512:84FF4C085E809A6129638674CFA1619DD42F42D60C160677EA7F32A93EEC09877BB25E61213D3C921A9DBDDB816873D6A929F085681E57E87D6D5C7B67D2858E
                                              Malicious:false
                                              Preview:0\r..m..........Hf.E....7.....0.............).......#3...................,T.8..`....`&.....L`......L`.....,T....`....`.....TLb&.............Sb...............`.....(Sb.`............Rd..l.....loadReader..`....Ib.............$Sb.................Rd........historyCounta......... ..Rc.(......chrome....Rb..}.....tabs..Rc..C.....query............q.......,T...`....`.....<L`......Rb.ek#....url........Rc~..Z....protocol..Rc.5.r....http:.....Rc.^......https:.......I..."...8..b.............HC.....RbV.".....tab......C..Rc.XmO....favicon.C..Rb........dataC.8Rl..Va*...https://www.google.com/s2/favicons?domain=...`.d...D..(.............-.....!...-......i........_-......k....-......k...G-......l...;.....-....}..).-...3...-...3......-...w8..3.....3...^.......(Sb...........I`....Da.........(. ..f..........@...X......@.......H......LQ.H...?...chrome-extension://hnaldbmaaihebfkndlpogamgccddckad/lib/util.js.a........Db............D`.....,.I.`............<..,T....`....`.....LL`"....8Sb.............Rb...&.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\297ecea5cebb5dfe_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8558
                                              Entropy (8bit):4.267431898461481
                                              Encrypted:false
                                              SSDEEP:192:ipTONGeC33yiY2XEiXlm2M9d89TOLTkUte:ip28T9Tqe
                                              MD5:C03C35467A787EA70413B869BFF060C2
                                              SHA1:AA8C81BF7DC26B0FDFABC30E481E3565FC402781
                                              SHA-256:78356D26A6B0146818C16FB7FE8B85573916EE7B92816D42BE6748B50C3CAF6E
                                              SHA-512:1E6E754DDEFCFCD6C37FDB41BCE9ECBA58BFD7D6EDF04AC0699B9AB1D64C9885DCAFF73C5581A18435CCE7320DA985505173D3484A28DEF28DFA201D00629DCF
                                              Malicious:false
                                              Preview:0\r..m...........&......8// Extension Class..function extension() {. const NT_COOKIE_NAME = "newtab_path";. const CONFIG_COOKIE_NAME = "ext_config";. const TY_COOKIE_NAME = "ty_url";. const NT_PAGE_PATH = "/newtab/index.html?direct=true";.. const init = config => {. this.config = config;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].get([name], ret => {. resolve(ret[name]);. });. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.err

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\297ecea5cebb5dfe_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):12265
                                              Entropy (8bit):6.063966896335001
                                              Encrypted:false
                                              SSDEEP:192:i8EyZ7yw2MQ+vy8II4jyjYvEm5rOe+ouuBKVMQjAR2zFEQC+xhS+tbRvCJobah3n:ikZeUvtdtYV6PorBKpAR2zFK+NhE3n
                                              MD5:F8757ADF261EFC531CF97C582250128D
                                              SHA1:2E4E2ADA9619A21F0AB43352351A9EAC3782C764
                                              SHA-256:93947C1C2C9BEB6CF611F046921698F232893A99FC0945B30EB5506FE31CF7B7
                                              SHA-512:3A4C6CA2E7F5188E233CEF2E8025772D5444FFFCA642C08B399A3C3C471E6DA7B730AADFE481F6DC574704BEA7FB39501B1B551534CEA0D3B5FE550F6BD9FCA0
                                              Malicious:false
                                              Preview:0\r..m...........&......8.....0.............).... ..#3....../...........,T.4..`....`......L`......L`.....,T..`....`p....tL`6.....Sb................ Rf.F.N....CONFIG_COOKIE_NAME....Re.7......TY_COOKIE_NAME....Rd.C.h....getSetting....Rd........setSetting... Rf..O[....updateCWSAndLPTab.....Re6}.[....getConfigCookie...Rc^......openUrl...Rd&..R....updateHash....Rc>.=Q....install...Re...I....startupHandler....Rd...[....setUninstallk..................................................Rdz.3.....extension...`....DaL....?....Rd.......newtab_path...Rd.2=/....ext_config....Rc........ty_url...,Rib......./newtab/index.html?direct=true...,T.0.`....`......L`......Rc.......config.....De.................2.......(Sb.............Rb.-.D....init`....Da....F.........b.............H......LQ.Hj.>...chrome-extension://hnaldbmaaihebfkndlpogamgccddckad/lib/ext.js..a........Db............D`.....|.I.`:...........`..,T.P..`....`V.....L`.....8Sb............y...Rb...Y....synca.........(`....Daz.............,T.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):751
                                              Entropy (8bit):5.57689364700216
                                              Encrypted:false
                                              SSDEEP:12:7/IfRg7zYnF+EHB0WRo19o2kYTVgJZqg0opDl990YXif9R9qetG5QmbwOfKNy:7/YRSu8EHRo/AYT+qg0op5jkfN8wOSNy
                                              MD5:044C098C46AFF8B99B4536F78BFDCF5C
                                              SHA1:C0892D8D59B537908147E6A183375384304851A0
                                              SHA-256:BCCA203697BEA3148E7A656E3D1A873B0091E9C79E72C2A2C66CD9114FF5340B
                                              SHA-512:257EDD515F376251FCD24DB37070C387BDAFFA1FCC493E1D751CFBFFBC8B87242D55AD74AE557BB37E6B3C88DC27DE6B1EAE2A7694F203CC6F379F6E69283E36
                                              Malicious:false
                                              Preview:0\r..m..........rSG.....0importScripts("lib/ext.js");.importScripts("lib/native.js");..const ext = new extension();.const native = new nativeMesseging();.ext.init(. {. apiDomain: "clearbar.app",. EType: "o",. },. native.);..chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.// Generated at Thu, 08 Dec 2022 04:13:39 GMT..A..Eo........."....................................HTTP/1.1 200 OK.Content-Security-Policy: script-src 'self';.Service-Worker-Allowed: /.ETag: "GEhfCiy6B9dGdO9lwgsTYemVByI=".cache-control: no-cache.Content-Type: text/javascript.Last-Modified: Thu, 08 Dec 2022 04:13:38 GMT..........._..f..o8.Rxlmily...9.N..g).:'.W..A..Eo......dl]%........

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1685
                                              Entropy (8bit):4.660173481294654
                                              Encrypted:false
                                              SSDEEP:24:Hsr624VNIdBugBPJOlH6iNIIHl6l+7Sw7ctAKqg0op7gN8wO:Mr63VUFROoiTH0lNXtr7gaT
                                              MD5:E0E15F1466D262E5D87F00F632B0BC5C
                                              SHA1:B965459ECBDB098875F41E2D8110F0E3CC7AB568
                                              SHA-256:6E9F6F7DA5188006A09CC69686D3FAE1ABBFF753FBC640DE93E44847BDD323C3
                                              SHA-512:422D1C93A85DA871E9B1313C03AFAF27D84DE132CD8A16D88C56593A9F6C4354F171AD31C66CB49331EF75DDD4101E2C902319AC38A2E106E07DC4C0C2AD06D2
                                              Malicious:false
                                              Preview:0\r..m..........V.......1// Extension Class..function extension() {. const init = (config, native) => {. this.config = config;. this.native = native;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. if (this.config[name]) resolve(this.config[name]);. chrome.storage[sync || name === "guid" ? "sync" : "local"].get(. [name],. ret => resolve(ret[name]). );. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.error(e);. reject();.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):2897
                                              Entropy (8bit):5.352887999562394
                                              Encrypted:false
                                              SSDEEP:48:+RxJbnDZziX9E8ve1BWcZMOhhM6yXbI+CCFm4thls:+LxDtO6ae1BgOhvyXbrCCFM
                                              MD5:578B1E4F8D3E4C9B60684FBC8531FE40
                                              SHA1:E2E2FA93E36742794FB6CA7295E89264770F564E
                                              SHA-256:D068940C66859A2223EED3E569D2D09C5F5BCC9D1BFDC753C6EDAB4EC8F9939A
                                              SHA-512:C214F8783431493226FAACAD79DC33173879CBC916B0A904CDA32D0D56AFC4F89F781416415950BB064CB1D5FF9765596ACDF31F32FD76BBE6F806189990275C
                                              Malicious:false
                                              Preview:0\r..m..........V.......1.....0.............)...@...#3...................,T.4..`....`......L`......L`.....,T.l.`....`.....8L`.....,Sb...............`......Rdz.3.....extension...`....DaL... ....,T.8.`....`(.....L`......Rc.......config........Dg.................2........2......(Sb.............Rb.-.D....init`....Dax...&.........b.............H......LQ.Hj._>...chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/lib/ext.js..a........Db............D`.....4.I.`............$..,T.P..`....`V.....L`.....8Sb............y...Rb...Y....synca..........Rd.C.h....getSetting..`....DaZ.............,T..`....`J....@L`.....0Sb............m.`$...I`....Da.........X.0...Rc.(......chrome....Rc...K....storage..\..Rb...q....guid..RcN.r.....local....m....e.`......La.........,T.8..`....`$.....L`.....y....Dg...................../...b.......(Sb...........I`....Da.........p....b.............@e..........................Sb................`......q...2V...Kd ...................D..0..................%.........-.....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1685
                                              Entropy (8bit):4.667725926659304
                                              Encrypted:false
                                              SSDEEP:24:Vr624VNIdBugBPJOlH6iNIIHl6l+7Sw7ctAKXhpqgJR/JkjnS:Vr63VUFROoiTH0lNXtz7qgJR/JkjnS
                                              MD5:68726327F4A9203B35C1908B0AAC8EFC
                                              SHA1:A6F14314E8258E46CE21159242190EE33D0A3876
                                              SHA-256:8B4FD6AE208E6E584A9CB48AD57ED902115EC953D05ABA1F64E3F9D4AA08499D
                                              SHA-512:E4CEAF9553F04E4AA54E06DA7A8700C892E9763F9F2636267FC835B8C122B06B5D5FBE3B12AA38038595FE3F255F47F9A6A8D412CA2C7329422A15D809FA2912
                                              Malicious:false
                                              Preview:0\r..m..........Q.......4// Extension Class..function extension() {. const init = (config, native) => {. this.config = config;. this.native = native;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. if (this.config[name]) resolve(this.config[name]);. chrome.storage[sync || name === "guid" ? "sync" : "local"].get(. [name],. ret => resolve(ret[name]). );. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.error(e);. reject();.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):2897
                                              Entropy (8bit):5.352810061421916
                                              Encrypted:false
                                              SSDEEP:48:CKRxJbnTZziX9E8ve1BWcZMOhhM6yXbI+CCFm4thl7:CKLxTtO6ae1BgOhvyXbrCCFb
                                              MD5:59CB50D8900B88456CF512850CA8B16E
                                              SHA1:7CE2131FD99E44DB4B106924F378D2354319E681
                                              SHA-256:33B90FBD9DF84A38BC906F7A6DEE69D4A0C0B1E6D0F1564F6B2243F39D5BFB17
                                              SHA-512:5FC8B78122462407711AA6AF8FFFD2873CCA650F4FF12E5BF00C4E5AA0CADE14ECA92D9437E45EF66C86DBA287771903E8F1B497D1552CA0C53EDCB840391903
                                              Malicious:false
                                              Preview:0\r..m..........Q.......4.....0.............)...@...#3...................,T.4..`....`......L`......L`.....,T.l.`....`.....8L`.....,Sb...............`......Rdz.3.....extension...`....DaL... ....,T.8.`....`(.....L`......Rc.......config........Dg.................2........2......(Sb.............Rb.-.D....init`....Dax...&.........b.............H......LQ.H.M..>...chrome-extension://lhgbhkaddoclgompehjgnoabldpmpkno/lib/ext.js..a........Db............D`.....4.I.`............$..,T.P..`....`V.....L`.....8Sb............y...Rb...Y....synca..........Rd.C.h....getSetting..`....DaZ.............,T..`....`J....@L`.....0Sb............m.`$...I`....Da.........X.0...Rc.(......chrome....Rc...K....storage..\..Rb...q....guid..RcN.r.....local....m....e.`......La.........,T.8..`....`$.....L`.....y....Dg...................../...b.......(Sb...........I`....Da.........p....b.............@e..........................Sb................`......q...2V...Kd ...................D..0..................%.........-.....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1015
                                              Entropy (8bit):5.697544181516458
                                              Encrypted:false
                                              SSDEEP:24:KgQgxYR7NGxFBILFMPk1PkbY/AYT3ruNKXftpNkfPE/JkfvtJ:vrILFX+bY/AYT3S+fHNkE/Jk3L
                                              MD5:1357E7C6AEA60ABF8ABC7CFD38762ED7
                                              SHA1:E834E850B390DC3866584B3DE92B1423E7F15FA6
                                              SHA-256:EFE82781B0A477A635615110D2BCA554D74E7349A0B002789BF2E37934AC9C66
                                              SHA-512:C12C58F4F22437DAAD06D1AC1154750D384C4D9AA6A941B243E69AC9C5971391AB8CAF65852E5112462194A292A6A5DE8A52826CDB89AF98684DE1DE6F884984
                                              Malicious:false
                                              Preview:0\r..m...........[......6importScripts("lib/util.js");.importScripts("lib/ext.js");.importScripts("lib/tabs.js");..const ext = new extension();.const config = {. apiDomain: "easyprint-api.app",. yID: "235",. uninstallID: "48824Ly9hcmNhZGV0YWIuY29t",. eType: "c",. queryParams: ["guid", "extId", "EType", "installDate"],.};..ext.init(config);.const tabs = new TabListener(ext);.chrome.tabs.onActivated.addListener(tabs.onActivated);.chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.chrome.action.onClicked.addListener(ext.actionClickedHandler);..// Generated at Wed, 05 Oct 2022 20:43:41 GMT..A..Eo.......8$q....................................HTTP/1.1 200 OK.Content-Security-Policy: script-src 'self';.Service-Worker-Allowed: /.ETag: "2KqP3j3D5SX1gc9+D4WQNQicwQc=".cache-control: no-cache.Content-Type: text/javascript.Last-Modified: Wed, 05 Oct 2022 20:43:40 GMT...............wn...3.T.O.o}....8z_.......A..Eo...

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):886
                                              Entropy (8bit):5.607575556047163
                                              Encrypted:false
                                              SSDEEP:24:x8YRSu8EHRo/AYT3MPkR0CHnM60CH7pXhpBkfJR/JkjY/I:xrVHRo/AYT3XR0ml0A97BkxR/JkjYw
                                              MD5:37570DD2428718D79F43456153F5609E
                                              SHA1:3573F0A480482B9D20A693A1251BC5F6B03D3676
                                              SHA-256:23E1A1395E52AFF78F666CA02C85638412CC23721B814DD35E62757D5731B179
                                              SHA-512:555FA2F1EF5AB0522243EB532C7CE02ED37E6DA3BA64F303D207134906D681933CFB0A72551B933D7118B958058322EEFE3D38918F273953BF41DC29AD4FF9E4
                                              Malicious:false
                                              Preview:0\r..m..................3importScripts("lib/ext.js");.importScripts("lib/native.js");..const ext = new extension();.const native = new nativeMesseging();.ext.init(. {. apiDomain: "clearbar.app",. EType: "o",. },. native.);..chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.chrome.tabs.onActivated.addListener(native.onTabChangeListener);.chrome.tabs.onZoomChange.addListener(native.onTabZoomChangeListener);.// Generated at Wed, 05 Oct 2022 20:37:15 GMT..A..Eo......dm......................................HTTP/1.1 200 OK.Content-Security-Policy: script-src 'self';.Service-Worker-Allowed: /.ETag: "5cF9dfqRWe31J2AT09F7VfaR0/Q=".cache-control: no-cache.Content-Type: text/javascript.Last-Modified: Wed, 05 Oct 2022 20:37:14 GMT...........N.@.b..`........"0.}..d.~G)....A..Eo.........C........

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\d0757ff92c7cde0a_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1032
                                              Entropy (8bit):5.035330977978622
                                              Encrypted:false
                                              SSDEEP:24:HoXkKuKhEW+R5XRCyE0kcKXftpUgPE/JkH:IUJu9M5XRCyEfXfHUgs/JkH
                                              MD5:9C25AE23A47AAB57A0349D263FB11E2C
                                              SHA1:376023B2A37DD964E8785D5C6F0C85F92DFA6EE4
                                              SHA-256:F7055B830EF4AC0342D34C5E69325E5BCA28AE3C6917A4EA184A018F5237E344
                                              SHA-512:E2B2C1D309630DAD5598A2D8D4CC8628FD30678D624ADC73D49534B7CE632B0A96987D97303E6FFD99C0ABB899A4055F0B3D5B132994DCB0F98526E021A03673
                                              Malicious:false
                                              Preview:0\r..m..........7.1.....9function TabListener(ext) {. const onActivated = async activeInfo => {. activeTabId = activeInfo.tabId;. const tabs = await chrome.tabs.query({. currentWindow: true,. });. if (tabs && tabs.length) {. const tab = tabs.filter(t => t.id == activeTabId)[0];. if (tab) {. if (. tab.url.indexOf("http://") !== -1 ||. tab.url.indexOf("https://") !== -1. ) {. await ext.setSetting("lastActive", activeTabId);. }. }. }. };. return {. onActivated,. };.}..// Generated at Wed, 05 Oct 2022 20:43:41 GMT..A..Eo........SH....................................HTTP/1.1 200 OK.Content-Security-Policy: script-src 'self';.ETag: "2KqP3j3D5SX1gc9+D4WQNQicwQc=".cache-control: no-cache.Content-Type: text/javascript.Last-Modified: Wed, 05 Oct 2022 20:43:40 GMT..............X.'.|...... G.g.k....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):2068
                                              Entropy (8bit):4.535636847034471
                                              Encrypted:false
                                              SSDEEP:48:zs9y/kRM7szx1nLtfKVuXRJwtxZr5bEMggaTX:49ylGNZkZr1E
                                              MD5:98CAD5FA2826EDA9C3C71B478516D056
                                              SHA1:27BF755C2AA22124CC8E1EEC91BC1B041B0C5BC1
                                              SHA-256:266584E99C265D3582FE9D4FD68192C08DB6EDF82FBE0BC9FFE4E58A8FAC6947
                                              SHA-512:7BC30C3BAB6A60B0C05EB55489D07177EFA3EDD727DC65DF4C55866FB93C65169FE27B0F63338E657190E39E789468B7D59187479E7DEB99E381F8494462735A
                                              Malicious:false
                                              Preview:0\r..m..........!......2function nativeMesseging() {. /**. * Purpose of this code is to maintain a live connection to the active clearbar.. */. const barPort = null;. const barPortTimer = null;. const lastConnUpdate = null;. const importDataUrl="chrome://settings/importData";. // Try to reconnect to clearbar every 60 seconds. const nextBarDelay = () => {. return 600000;. };.. // Timer fired to initiate a connection. const onBarTimer = () => {. startBarConnection();. };. const openImportPage = ()=>{. chrome.tabs.create({. url:importDataUrl. });. }. const postMessage = message => {. if (!this.barPort) return;. this.barPort.postMessage(message);. };. const startBarConnection = () => {. try {. chrome.windows.getCurrent((w)=>{. if (w){. this.barPort = chrome.runtime.connectNative(. "com.clear.application".

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):2593
                                              Entropy (8bit):5.298420962634586
                                              Encrypted:false
                                              SSDEEP:48:VkvN++5X82ZY5cMed8YVdcId1xj1FW/us+w:Vks+VYCMBYV55K/Nr
                                              MD5:28FCEDC11333AD0ACA65E8B6E1720B0A
                                              SHA1:8096187B218BA3154BAF9EAC5A51C6F8714819DC
                                              SHA-256:6B07FEE9B2EA5DB176492A23D3CFAFBA28913A08F1204E1F166108380E90E347
                                              SHA-512:81227C3CBF981663F521D0170AC9D62749E8479C3199CF263E2CF255FFFBF36E5619D3EF4A69F2F7CBF86A3D0967D1D1A3825DAAD5E369788578780B6B68024E
                                              Malicious:false
                                              Preview:0\r..m..........!......2.....0.............)......#3...................,T.4..`....`......L`......L`.....,T.t.`....`.....,L`.....TSb.................ReJ5......importDataUrl.....Rd.f......nextBarDelay..Rd...~....onBarTimer....RevSgD....openImportPage... Rf........startBarConnection..e..........................Re...`....nativeMesseging.`....Da0........(Rh:.......chrome://settings/importData.,T.,.`....`....]...Dd...............'.....(Sb............$`....Da..............H......PQ.L.j.DA...chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/lib/native.js...a........Db............D`.....0.I.`............<..,T.0..`....`......L`.....0...De.................a.......(Sb............(`....Da..............b.............He..........................,T.H.`....`D.... L`......Rc.(......chrome....Rb..}.....tabs.........b..............Rb.ek#....url.C. ...Dk............!...-....-....}..).....3...^.........(Sb............,`....Da(...........c..........P......e..........................,T.D..`....`>.....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):3588
                                              Entropy (8bit):4.398211442489856
                                              Encrypted:false
                                              SSDEEP:48:zus9y/kRM7YxLVNQdCgdVMWkWCOwtfKVuXRJwtxkESSr5bqAQpJAX/Qdb7YgJR/p:H9ylEJKCgn4WCxkTr17FXiw2
                                              MD5:BC795E75B80A2606F0A7C56ED1F34387
                                              SHA1:93D35767AFAC3B2D76DE14C417FDA47C81A51B38
                                              SHA-256:E3CAAB5F8F8E3AB7FF631BFAEAD166195486F3E5D3CFC6DAF8AD07104F5A7373
                                              SHA-512:E30E465F4429F94DEE1B4CEE759D7B89EAA52757E6A85F5647444E8715A32C2118091184775ED4DA5166427B25A9A5BDEA1FE0BB5A2038A4D15ED0BC37C56C62
                                              Malicious:false
                                              Preview:0\r..m.................5function nativeMesseging() {. /**. * Purpose of this code is to maintain a live connection to the active clearbar.. */. const barPort = null;. const barPortTimer = null;. const lastConnUpdate = null;. // Try to reconnect to clearbar every 60 seconds. const nextBarDelay = () => {. return 600000;. };.. // Timer fired to initiate a connection. const onBarTimer = () => {. startBarConnection();. };.. const getZoomValue = async () => {. chrome.tabs.query({ active: true }, tabs => {. if (tabs.length > 0) {. const tab = tabs[0];. if (tab.url.indexOf("https://")!==-1 || tab.url.indexOf("http://")!==-1){. chrome.tabs.getZoom(tab.id, zoomValue => {. postMessage({ Type: "zoom-value", Value: zoomValue });. });. }. }. });. return true;. };.. const setZoomValue = async

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):5209
                                              Entropy (8bit):5.500526236530927
                                              Encrypted:false
                                              SSDEEP:96:Zni1eSqiRv9PLl40psflRh+NY/zI5zyLxIAgsAOvlHT0T:ZmeA19PLl4AsflbdMNaxIAgslF2
                                              MD5:67B7CA18E17B139C97E1EFD15A53E737
                                              SHA1:F96B731C705D3C4043FB43BA2D5304A29BC0E9F9
                                              SHA-256:10F2189E97F8726161ED9BA469B0F2B2F9259705386980CFA0EB18491F3EC430
                                              SHA-512:BE8B66DCC8342D7F3A9B20B1CCD2F4AA3835ADD88E1FC6B78A4FBE279E00F335833E1A7B91AB103FBB2B75F9E58783C7E26CB65F9517AA0BD5D6FABC2386B1BB
                                              Malicious:false
                                              Preview:0\r..m.................5.....0.............)......#3...................,T.4..`....`......L`......L`.....,T...`....`.....<L`.....\Sb.................Rd.f......nextBarDelay..Rd...~....onBarTimer....RdF.......getZoomValue..Rd..2.....setZoomValue..b... Rf........startBarConnection..f..............................Re...`....nativeMesseging.`....Da0........,T.,.`....`....]...Dd...............'.....(Sb............ `....DaT.............H......PQ.Lr.S`A...chrome-extension://lhgbhkaddoclgompehjgnoabldpmpkno/lib/native.js...a........Db............D`.....P.I.`$...........8..,T.0..`....`......L`.....0...De.................a.......(Sb............$`....Da(...~.........b.............De..........................,T.p.`....`..... L`......Rc.(......chrome....Rb..}.....tabs..Rc..C.....query.......b..............RcR^......active..G.,T...`....`.....0L`.....q...Rb.ek#....url........Rc2..L....https://..Rc.?.....http://..p.t..Rc.K,.....getZoom.....,T.<..`....`,.....L`......b... .b..............Rb........Ty

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):2.1431558784658327
                                              Encrypted:false
                                              SSDEEP:3:m+l:m
                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                              Malicious:false
                                              Preview:0\r..m..................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PDP-11 overlaid pure executable not stripped
                                              Category:dropped
                                              Size (bytes):288
                                              Entropy (8bit):3.8640059831240112
                                              Encrypted:false
                                              SSDEEP:6:BMAns4XMuIu//Y6xXaEQXa6+JTO4YXsQkKl:+AskMROzBaTXahTOzcLKl
                                              MD5:5FC70768D95FC8EA59E2FEA87AC8D2C4
                                              SHA1:FB24FAEABE2C2518A8B9302A79F8C98491C17C39
                                              SHA-256:3C6221BA1046A08B163B027BF62FCE830507906221F7A7747DE384D0B8B34359
                                              SHA-512:C4087B06012C948EFFB408E5C51C0B096CFAF7515B9845FDEA5A2CBE779B3A306BBE2A3CD350DF1012E449126D6CB72B0449045BC7943575E25DBE85365E3AA7
                                              Malicious:false
                                              Preview:........oy retne..........................|,..u.$................+...8.$................]...~)$........R......w.h...#.<...............5j.+y..L$................4x.<..$........#.......dS.$s.g$................K.7....$..................n..<................X....,<....................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PDP-11 overlaid pure executable not stripped
                                              Category:dropped
                                              Size (bytes):288
                                              Entropy (8bit):3.8640059831240112
                                              Encrypted:false
                                              SSDEEP:6:BMAns4XMuIu//Y6xXaEQXa6+JTO4YXsQkKl:+AskMROzBaTXahTOzcLKl
                                              MD5:5FC70768D95FC8EA59E2FEA87AC8D2C4
                                              SHA1:FB24FAEABE2C2518A8B9302A79F8C98491C17C39
                                              SHA-256:3C6221BA1046A08B163B027BF62FCE830507906221F7A7747DE384D0B8B34359
                                              SHA-512:C4087B06012C948EFFB408E5C51C0B096CFAF7515B9845FDEA5A2CBE779B3A306BBE2A3CD350DF1012E449126D6CB72B0449045BC7943575E25DBE85365E3AA7
                                              Malicious:false
                                              Preview:........oy retne..........................|,..u.$................+...8.$................]...~)$........R......w.h...#.<...............5j.+y..L$................4x.<..$........#.......dS.$s.g$................K.7....$..................n..<................X....,<....................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF6c1678.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PDP-11 overlaid pure executable not stripped
                                              Category:dropped
                                              Size (bytes):288
                                              Entropy (8bit):3.8640059831240112
                                              Encrypted:false
                                              SSDEEP:6:BMAns4XMuIu//Y6xXaEQXa6+JTO4YXsQkKl:+AskMROzBaTXahTOzcLKl
                                              MD5:5FC70768D95FC8EA59E2FEA87AC8D2C4
                                              SHA1:FB24FAEABE2C2518A8B9302A79F8C98491C17C39
                                              SHA-256:3C6221BA1046A08B163B027BF62FCE830507906221F7A7747DE384D0B8B34359
                                              SHA-512:C4087B06012C948EFFB408E5C51C0B096CFAF7515B9845FDEA5A2CBE779B3A306BBE2A3CD350DF1012E449126D6CB72B0449045BC7943575E25DBE85365E3AA7
                                              Malicious:false
                                              Preview:........oy retne..........................|,..u.$................+...8.$................]...~)$........R......w.h...#.<...............5j.+y..L$................4x.<..$........#.......dS.$s.g$................K.7....$..................n..<................X....,<....................w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:modified
                                              Size (bytes):156
                                              Entropy (8bit):2.9521491291801043
                                              Encrypted:false
                                              SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljl:S85aEFljljljljljl
                                              MD5:FA1AF62BDAF3C63591454D2631D5DD6D
                                              SHA1:14FC1FC51A9B7CCAB8F04C45D84442ED02EB9466
                                              SHA-256:00DD3C8077C2CCA17EA9B94804490326AE6F43E6070D06B1516DFD5C4736D94D
                                              SHA-512:2C3184F563B9A9BFF088114F0547F204EE1E0B864115366C86506215F42D7DBF161BC2534CCAEE783E62CC01105EDFFC5F5DABF229DA5EBD839C96AF1D45DE77
                                              Malicious:false
                                              Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f...............

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):285
                                              Entropy (8bit):5.146699871636803
                                              Encrypted:false
                                              SSDEEP:6:DsbFSq1cNwi23mrXgNrQM72KLlps3J9+q2PcNwi23mrXgNrQMxIFUv:DOUcZmG/Lr6qvLZmGCFUv
                                              MD5:1EB19A4A114C75E4E8A1E3EAFA2FAAC1
                                              SHA1:91667015AFF4111F95B68F4359751278A268A5D7
                                              SHA-256:93366559D6950DBAF1BB13376E5B2D22F8C9715E298C74D1AA08A28659C742AB
                                              SHA-512:1F001C799EB591388316483BBBAD1A3DDE269C161076A8953044825C7FFEF74FA195E501F81F33137B6D5FB115AE90E920DD62C704C7AA3F77A4764F0F0F2178
                                              Malicious:false
                                              Preview:2024/05/22-13:35:01.587 1e88 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage since it was missing..2024/05/22-13:35:01.697 1e88 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Session Storage\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sessions\Session_13360872903789425

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1183
                                              Entropy (8bit):3.4734110510616163
                                              Encrypted:false
                                              SSDEEP:24:3JyT5c46GrpqQQvKSnKeka8fRfAa7ImbK:3Iz6QpqQuKbr7ImW
                                              MD5:1DCC44DD2BF16C902EA9A38B792E40C1
                                              SHA1:5E083C285D340E47C8D7D9E85C289534AB5727DF
                                              SHA-256:3C3FACFD5BC5E31555FF7875DACEF07FF47639BAA896856C0E5071F13C4F6616
                                              SHA-512:491024033DE48576D63CF2B1A4C5C4496E588D3C74FE469B135BAB14427E564FEE996F5CAEAB4F68EA61CA4D7B8F4C3378F5957C4DDADE01856F7319EF4A271F
                                              Malicious:false
                                              Preview:SNSS........C.O............C.O............C.O...... .C.O........C.O........C.O....!...C.O................................C.O.C.O1..,....C.O$...2eb83d6a_2c1f_47e4_87fb_553f300acba5....C.O........C.O....oA-..w/.....C.O....C.O...........................C.O.......|....C.O........chrome://newtab/............!............................................................... ...............(............... .......3:jZ....4:jZ....`.......x...............p...........................................................E...c.h.r.o.m.e.-.e.x.t.e.n.s.i.o.n.:././.c.h.b.o.n.i.o.e.p.c.g.o.o.l.p.a.l.j.f.i.a.e.k.e.j.i.d.o.n.n.b.a./.n.e.w.t.a.b./.i.n.d.e.x...h.t.m.l.......................................8.......0.......8....................................................................... .......................................................P...$...c.e.3.e.5.2.b.6.-.e.8.7.0.-.4.3.0.9.-.a.e.a.4.-.c.9.0.2.2.b.8.3.6.6.8.6.................P...$...3.0.4.0.4.4.c.f.-.7.9.3.b.-.4.5.7.5.-.9.f.3.b.-.9.5.3.f.a.1.c.3.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Shared Dictionary\cache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):2.1431558784658327
                                              Encrypted:false
                                              SSDEEP:3:m+l:m
                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                              Malicious:false
                                              Preview:0\r..m..................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Shared Dictionary\cache\index-dir\temp-index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.9555576533947305
                                              Encrypted:false
                                              SSDEEP:3:e5HhKaEz9S+:e5BK1z9S+
                                              MD5:C1D45CCF2FEB8CFB5C03641DFACF5B29
                                              SHA1:C160B047505BD8C70834A10CE44D76BF77019415
                                              SHA-256:5F49E77B286B1B7BF2A91FBC75446D6FA25FE32C63344FE067042EC88F17D28D
                                              SHA-512:DB7A2306AC894763B9E9832D56057A389FFD82D0EFE56AE0EFE5C601F5096EF12CC37BF7E4578A44772F37EE6E6B42A7F85EEE351B44D313B676FD38710662D1
                                              Malicious:false
                                              Preview:(.....bDoy retne........................oM.w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):48
                                              Entropy (8bit):2.9555576533947305
                                              Encrypted:false
                                              SSDEEP:3:e5HhKaEz9S+:e5BK1z9S+
                                              MD5:C1D45CCF2FEB8CFB5C03641DFACF5B29
                                              SHA1:C160B047505BD8C70834A10CE44D76BF77019415
                                              SHA-256:5F49E77B286B1B7BF2A91FBC75446D6FA25FE32C63344FE067042EC88F17D28D
                                              SHA-512:DB7A2306AC894763B9E9832D56057A389FFD82D0EFE56AE0EFE5C601F5096EF12CC37BF7E4578A44772F37EE6E6B42A7F85EEE351B44D313B676FD38710662D1
                                              Malicious:false
                                              Preview:(.....bDoy retne........................oM.w/.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Shared Dictionary\db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 9, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 9
                                              Category:dropped
                                              Size (bytes):45056
                                              Entropy (8bit):0.4080142925396409
                                              Encrypted:false
                                              SSDEEP:24:TL6iiaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2HaOk17ZfnUdoqSB
                                              MD5:4D4863CE15EC9C7DFDC50C288A2D2D1A
                                              SHA1:4494A5C4EAB04AF1EFC9A2D7E1D996064D489512
                                              SHA-256:2EF9AB8EC9E6B879A77D1D9DBE7D18A2171F50FF37E803BBD0243AF1B87DCB15
                                              SHA-512:D34F62EAC5F9F0540ED0C6F3C6FCF6713C4546A5625EEDC43ECB2CEAD6AF30B387764703637FDAA4AE69D0B6CD31B2E47D6639C41B841D46327886C7A5741247
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g.....~.........Z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Shortcuts

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.44164997779071236
                                              Encrypted:false
                                              SSDEEP:12:TLiNypcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLi+VMnYPhIY5Qlvsd6UwccNp15fB
                                              MD5:34EED7E558881173F821F97051363E60
                                              SHA1:DC51132BD3ABC24D8CB7D01FD90B0EB4393B4369
                                              SHA-256:A25723CDC11363D399BB1F554A930CC946AB53B8A89BDA566F97BE7C8611DC53
                                              SHA-512:389BF70BDD760A0B1183E3E3D6844BD51D538396A0CED34490DC24D2816CB32717360AC5FBF6108ED95F3B4B6B6F071D642B745B21EB88B9F71A3974253F34A5
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):40
                                              Entropy (8bit):3.473726825238924
                                              Encrypted:false
                                              SSDEEP:3:41tt0diERGn:et084G
                                              MD5:148079685E25097536785F4536AF014B
                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                              Malicious:false
                                              Preview:.On.!................database_metadata.1

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):313
                                              Entropy (8bit):5.073479931795271
                                              Encrypted:false
                                              SSDEEP:6:Dsa+QR1cNwi23mrXgN7Uh2gr52KLlpsayyjyq2PcNwi23mrXgN7Uh2ghZIFUv:DIQ/ZmGIhHJLrE/vLZmGIhHh2FUv
                                              MD5:A9329266FC3678F975A3A343582B29C1
                                              SHA1:A5232F5FF89C8FF1F92D0071FAB2442F4BB48378
                                              SHA-256:756469BBBA6F374908D48C7C806987C3FA3B56C14842F380511B9366C4107152
                                              SHA-512:D5BB095130877E99C2D351AB15DE0594FFD13B940BE87E068A4E83E6102AEB35C8595D8214FEE0CFE279DA88AB2444ABC11BE430541C4A6C649F336CDB2A2BCF
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.443 1dc0 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database since it was missing..2024/05/22-13:34:55.485 1dc0 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Site Characteristics Database\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):46
                                              Entropy (8bit):4.019797536844534
                                              Encrypted:false
                                              SSDEEP:3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
                                              MD5:90881C9C26F29FCA29815A08BA858544
                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                              Malicious:false
                                              Preview:...n'................_mts_schema_descriptor...

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):289
                                              Entropy (8bit):5.201169729308952
                                              Encrypted:false
                                              SSDEEP:6:DsazoM1cNwi23mrXgNBx2KLlpsaj0Vq2PcNwi23mrXgNpIFUv:DG2ZmGBVLrSvLZmGmFUv
                                              MD5:EBBAF81A52406646C7FCAE959AB91CE9
                                              SHA1:AC9A383A9472BFAF78CED99215714A5E85003362
                                              SHA-256:BD5E35B8A193ECDFE188CE4239EE3790369C357FB5274A6BD3CEFFFA35D39FC2
                                              SHA-512:26D7F32059A76E80133E899665FEEA645007BCA849CAF3F74FA2302D6CFE85E366E1620FAA3450C42D07D1EF5F4C8A221A0AF76189BFC99373ABBEEB850546FA
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.394 1064 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB since it was missing..2024/05/22-13:34:55.437 1064 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):33
                                              Entropy (8bit):3.527613882842991
                                              Encrypted:false
                                              SSDEEP:3:bpti7Vl:Fti7Vl
                                              MD5:7E97B05A932B3195555B037269B5B40A
                                              SHA1:77DA914B4E5A503626C1ED1DD3EF58C1078A4922
                                              SHA-256:17483C6825B5E38127A3BAF82A2B0A000FAEE9D0C0AEF38A3772A42C5707468C
                                              SHA-512:1DBD4A6B4DBA0310F70090E58C731341BFEAE06358173B058E075E7CB3E12077E7FE5ACBFFA7582F8C5609A77A55D62523FAA32FA97891F6B98A2F73218BE08D
                                              Malicious:false
                                              Preview:H .S.................firstNT.true

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):367
                                              Entropy (8bit):5.21764617381171
                                              Encrypted:false
                                              SSDEEP:6:DsZFOj+RM1cNwi23mrXgNks8Y5kILMPvx2KLlpsZKq2PcNwi23mrXgNks8Y5kIL+:DGFOju2ZmGkOOUqVLrGKvLZmGkOOUFF2
                                              MD5:48821661C1AC5F94276F7D0ED374BDF4
                                              SHA1:C1387DC0DE12620FCD09B0AF7C445679634F6636
                                              SHA-256:D77DB25A5A6C033E31BCF52ABFE544D40B4FC72FF058B0F775605D260FFE91CA
                                              SHA-512:3DA9B99BA69433D9236A94247D4D2988660CEA7171F47C688EA3A89AC2D4F962CFE699A8A63E0E1AE82A41736F98F166021FFE0A26BFB26DD8572CF61A8917BB
                                              Malicious:false
                                              Preview:2024/05/22-13:35:14.413 1ce4 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad since it was missing..2024/05/22-13:35:14.474 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Sync Extension Settings\hnaldbmaaihebfkndlpogamgccddckad\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Top Sites

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.41215124037614637
                                              Encrypted:false
                                              SSDEEP:12:TL15CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSIoWccog8zcPccogL:TLLCZwE8I6Uwcco5fBITcchL
                                              MD5:E8CC4825C227D59B66476099DC25BC29
                                              SHA1:F6EC4D56D72553E4EAF4C000AC9D86107CFFB4F2
                                              SHA-256:74FC3F0A9BBC7BD4AAE7791513FEAA4FE7C51FFC6DAE5F34FDBA093FF8255426
                                              SHA-512:C4F0A591589052984E5BC8EE0402C8FE71A7CB9409626505262423FCE0E837F622B5F404FC611655D224FCE7FA4D0B279F563F94BBEC99AA225D98B086B996C3
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................[5.........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Visited Links

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):131072
                                              Entropy (8bit):0.007626164928413814
                                              Encrypted:false
                                              SSDEEP:3:ImtV+DCVGX4nkl//cjt/vWUlttdfhllll8AtX:IiV+DCVm4ntjtG+nllkaX
                                              MD5:D88325A5E13CF5C35523B4F584D5B21B
                                              SHA1:BA0D5C29AD8DEC9D3F9292C0C07090FBF9142D20
                                              SHA-256:B1FA5A2AD8CFE0C04C5422144FD942C437379E101F127BA941F8D84938235499
                                              SHA-512:6A2D97306DF7D6ADF0276D2728097347C24B899C16D3BAEEE672A23B0D1D462D94328454C2568041815EBAB7C26B7B935DB7BF2093B283FCE50857EC0F7F4453
                                              Malicious:false
                                              Preview:VLnk.....?.........3 ..G................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\Web Data

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, page size 2048, file counter 3, database pages 63, cookie 0x26, schema 4, UTF-8, version-valid-for 3
                                              Category:dropped
                                              Size (bytes):129024
                                              Entropy (8bit):1.118294494150745
                                              Encrypted:false
                                              SSDEEP:192:Wgbwl5VZTnOSTgabTMeHnvfjIX2cdggPsIOcVumZMy6c5wu/g4:Wcwl5fnzHnvfjIX2cdgCsIOcVum3HN44
                                              MD5:2F8FE89E32E426A28DB65C125DE1BF1D
                                              SHA1:43C639009EE131C299F2F8A1A5DDC8DB83F15C61
                                              SHA-256:8F643CBDB3449DE154A12A25E7CBD373B8A2928856414F46FA018DDE6A715A9A
                                              SHA-512:C3F02EBB17758ACC9FEC28B5EC2AF5A0A09D8C5A805C406F203A9E85C3601704ADFE08869F78B536698682EAEE8B55A3859018C2291BAF2CD1C8CB1A7500E6DA
                                              Malicious:false
                                              Preview:SQLite format 3......@ .......?...........&......................................................n............=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\WebStorage\QuotaManager

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):40960
                                              Entropy (8bit):0.6311404576479884
                                              Encrypted:false
                                              SSDEEP:48:T9j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBR2UwrwBCuXw:l7doKsKuKZKlZNmu46yjxRVEYXw
                                              MD5:E839D5644F59DA93328219B9DE09743E
                                              SHA1:575FC2B32AA8DE9230EE5A17077907C63C0A013F
                                              SHA-256:DF65CBD5170439DB06732F2DB1BB38F71DA73ECF48E0ECCE80442CACFE8D5F17
                                              SHA-512:6EE2B6604A3193C707955AF55B965E7B693FAC21A248BB43DA803F3892DF73F4217A06F03AA3736E4DB414822C37F02AD2FF27186394C658D0ACCA60B0474095
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\a976122a-61f4-41ca-8348-ace3e5b766e9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):163641
                                              Entropy (8bit):4.177191996481986
                                              Encrypted:false
                                              SSDEEP:768:qJi1ZGspTiOmvyiLMDdd97GsVUuZl8TsVwiGEnK7axhsKqNYPfkPQLcXqUgNMl0+:Pd9NkohhpPMPQLJG6GHEOFzDW1Jeku
                                              MD5:C845960127523CCD1F63C3BD03DD8662
                                              SHA1:A009544B3749C0887E76301A0617579DB430F4C9
                                              SHA-256:C68D79AA41CF5D93E29F9E2AC21E54747693E626AEF7CF987D7AEAFF2EED7D30
                                              SHA-512:31D0CF22DD0BAE63F056EFB5C75340F4C7B372F1C6072BD1410296AA268DA1DE6D7E2E1D82D0D6D4C241242D128FB422C11AA4F8575A6A9383A291D743E238AA
                                              Malicious:false
                                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ ..2...M..(............. .......................................7...E..............U.... ...............+......P.#.n...9......S.............P. .o...........................R...n..........................@ ..i.............t..............Y...z.................................D...R.............................................(............. ..............................U.......................................................................F...e.h...................[..........@...f.........................v.....Y&..O.M.V.............................P...h...5.............................J...f.......y...................v.........L...t.................!..................^............."...U..........................U........................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\d8fef916-68db-4e38-b965-eee00e1db044.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):13693
                                              Entropy (8bit):5.391434872680761
                                              Encrypted:false
                                              SSDEEP:192:rCUaMLUCGGNE3QkgexZx9JZLp9NtJt16hPlV+FptxfEyf2pFIOjPR6yIsnV2:r5xLFCmSLFz2NGp7z2pFIOw
                                              MD5:1EBE89DA5193FCA1DF33E003FBB17467
                                              SHA1:1ECE6323EF8BABED19303D2B4558C2C5F63B2E49
                                              SHA-256:842C524336B8833B4527E37CC7787B96756DD91A32544F28BB3D1DD922EEC14F
                                              SHA-512:6BF40B14A6C82A994C6D73F07DA5798DA341EF07ADB6ADAF483AEA0B3E36EBF7500052AF8A63D1F01F69E571141DDA7FF6ED8A71FB9AE9A0135715EF88B8FA9B
                                              Malicious:false
                                              Preview:{"account_tracker_service_last_update":"13360872896229903","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13360872895413359","apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":120},"browser":{"check_default_browser":false,"has_seen_welcome_page":false,"window_placement":{"bottom":974,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13360872895501743","countryid_at_install":17224,"default_apps_install_state":3,"default_search_provider":{"guid":"fdb04720-a531-475d-9308-f1decf03b346","keywords_use_extended_list":true},"default_search_provider_data":{"template_url_data":{"alternate_urls":[],"contextual_search_url":"","created_by_policy":false,"created_from_play_api":false,"date_created":"13242866705662805","doodle_url":"","favicon_url":"","id":"8","image_url":"","image_url_post_params

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\databases\Databases.db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):28672
                                              Entropy (8bit):0.34078652119264796
                                              Encrypted:false
                                              SSDEEP:12:TLiqiy5onGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiivNiD+lZk/Fj+6UwccNp15fBG
                                              MD5:B00150238DFC78C6F8BDE1723E39ECE3
                                              SHA1:533CC5B74870A83D2FECB04494901E88E6D001AE
                                              SHA-256:08EB1696D053F29F3E063EC63FC6087D69836A7A9B3F742D2CCC5799C2C5363B
                                              SHA-512:DE3DC35A4C186B25191C9CAA0EBEFAE8CB2251A701B56793606C8BD1DBDA072257BD8588CA220F0F4C206565F34A1B5A1875499AC818DCA9C0CF199B0FF55C6A
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\de4adea9-f498-41ab-919c-934136cbc100.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):3636
                                              Entropy (8bit):4.250941553397405
                                              Encrypted:false
                                              SSDEEP:96:NmrXtLqTXGeaTX0yULsxTXFgVGTXSfDEeMFX9Zlsp:/ECgCQu5eu
                                              MD5:AD7F5E9B2921D337AE27B8D19720F3F0
                                              SHA1:830463A0D9CBFA8488445D534163F10B0842E22D
                                              SHA-256:EA2BBFB654C3B6286A74684102CD7FB04E012477AFBBCBE46C3CB250B4918E6F
                                              SHA-512:3FC47E1D3E325D79C05B70A5B8A56E75FDF5866B843A74C9B5DD6D5F4499CB4FA5792F735E5427567D28245F4A210963012B823C22E78DF3EEBD9B3707E1DBE6
                                              Malicious:false
                                              Preview:{.. "checksum": "9f480330b31a3bd75d49b309d817947e",.. "roots": {.. "bookmark_bar": {.. "children": [ {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "44c9dbe7-3361-44ee-9442-ca46d90884b0",.. "id": "5",.. "name": "Amazon",.. "type": "url",.. "url": "http://www.amazon.com/".. }, {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "7b0cfb85-cb4c-41a1-b7dc-4f1f0ecc2a1f",.. "id": "6",.. "name": "Facebook",.. "type": "url",.. "url": "http://www.facebook.com/".. }, {.. "date_added": "13340966087182403",.. "date_last_used": "0",.. "guid": "b264426c-ca85-4ddd-b3d7-d440fd0079bc",.. "id": "7",.. "name": "Google",.. "type": "url",.. "url": "http://www.google.com/".. }, {..

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\f93eb13f-7b6b-435f-9d17-b451bcd6dba5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):12936
                                              Entropy (8bit):5.508518964324622
                                              Encrypted:false
                                              SSDEEP:384:nQKcPnO23ZFtbcj5fxBpMHlScXWfFreoLKDLd2p6IOH:QKSOAZ0jtxYFBXEFrfLKcpdG
                                              MD5:D689199A932FAE8B4F2582CACDB31F2C
                                              SHA1:B417D62FF1F67F3E41C71BA098CB570A59EE0C15
                                              SHA-256:1CACCC8FC6F3AD466227021E6F2D58B812B10AF534E6A2C7C29A4CE33CC14D70
                                              SHA-512:02C2670A319C27E1D4BADB127E2E342291B5CA728EE633E97D9F345DA70C5E645CB97BCB7B75B568D2CCCFA82D93E71F6E4CE0854DB7A43AAE3E887416EBEDBC
                                              Malicious:false
                                              Preview:{"default_search_provider_data":{"template_url_data":{"alternate_urls":[],"contextual_search_url":"","created_by_policy":false,"created_from_play_api":false,"date_created":"13242866705662805","doodle_url":"","enforced_by_policy":false,"favicon_url":"","id":"10","image_search_branding_label":"","image_translate_source_language_param_key":"","image_translate_target_language_param_key":"","image_translate_url":"","image_url":"","image_url_post_params":"","input_encodings":[],"is_active":0,"keyword":"clear","last_modified":"13242866705662805","last_visited":"0","logo_url":"","new_tab_url":"https://tab.clearbar.app/223/clear/index.html?guid=173f77d4-1d21-45bb-8074-7fb83cfed713","originating_url":"","preconnect_to_search_url":false,"prefetch_likely_navigations":false,"prepopulate_id":0,"safe_for_autoreplace":false,"search_intent_params":[],"search_url_post_params":"","short_name":"Clear","side_image_search_param":"","side_search_param":"","starter_pack_id":0,"suggestions_url":"https://meta.c

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\heavy_ad_intervention_opt_out.db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                              Category:dropped
                                              Size (bytes):16384
                                              Entropy (8bit):0.35198872583943963
                                              Encrypted:false
                                              SSDEEP:12:TLCzowaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLxdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                              MD5:C6293E287C0974EAF29C62256167B483
                                              SHA1:F068EA59A577BCCA8E8E9BE3ED6F1421302AE1FD
                                              SHA-256:6A100510937C44D5A7AE81C75012E2E849CC1B6E0AE92D4733C412AC4486D6F4
                                              SHA-512:9AFDD26CBD29A24B1D34548E6CD57598D3C2A14D85551171AB3FBC0A8D8DE54739C4B413840855D041CC409738885B815A1563B3493E49664BF4EF78B626909F
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\power_bookmarks\PowerBookmarks.db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 2, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 2
                                              Category:dropped
                                              Size (bytes):32768
                                              Entropy (8bit):0.3290177917065696
                                              Encrypted:false
                                              SSDEEP:12:TLUzxpXQHCyQ1rjL4KZYoLh+FsvPy8bUJOU5BC3+o0yk66wqyprFxOUwa5qguelI:TLsQsQsBqC1xr6Uwcc8jTe
                                              MD5:A5CBAB11BF4AB790B6F29FBFA684325F
                                              SHA1:C7BF547AC88115256CC65CBB45EBAB7E34B19C28
                                              SHA-256:DAFF8E1C9C8C8600FDFD575C7968BFCE5AD7CAE837A628EE638C6DDEBBB78588
                                              SHA-512:CB838D4C6CCB8234ED45713C69DDCF0010FF3D1EA01B3E89AAED986E901BDF51C6962C32FBD8B3481C03D178833C29247F388A4432DF87AF59598BA8EE51F98B
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......T..g.......g.T................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):6576
                                              Entropy (8bit):6.550431223236789
                                              Encrypted:false
                                              SSDEEP:192:q9bx7VSdGGC7RBaBXQXIIIfzmbzMIM6acYcYg:q917sdGDvaBXQXIIIfzmbzMIM6acBf
                                              MD5:B542D48835BB5C7A6D5F2C72B430DF95
                                              SHA1:E19AC78B6F8D811FB9A9A0405479AF0CB10C957F
                                              SHA-256:76E870BF51E145257175415030C64501BE9FDE6285812C4AC355D8FD1866E4EE
                                              SHA-512:88C95EDB8E8181E1E6DE43C56B5D05059267B74D7A07737AF7A6853B728F14B4D5B1373D82F35BE8BE0BFA9F062BC59350A9DF7BDD5288D5A5DC589F864221F5
                                              Malicious:false
                                              Preview:.f.5..................)................41_https://www.example.com/.,U.................20_1_1...1..&f...............@...................37_DEFAULT_16v...h.... .(.0.R*.(....Session.TotalDuration.T<.A..GO .(.0.../.'.%....?..ChromeLowUserEngagement..Other...... .(....10.0....................37_DEFAULT_21........... .(.0.RZ.X...CCommerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage.w.cG$.. .(.0.8.R9.7...$Autofill_PolledCreditCardSuggestions...c..vP. .(.0...$........?..ShoppingUser..Other...... .(....10...z. ................37_DEFAULT_23........... .(.0.RH.F...1Omnibox.SuggestionUsed.ClientSummarizedResultType.q/.v.g:` .(.0.8.Ra._.DSELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00'......................dh...8.0........?..Low......@..Medium......A..High..None...... .(....10......................37_DEFAULT_27........... .(.0.R=.;...."%..wait_for_device_info_in_seconds..60*.SyncDeviceInfoh.p...t.r.p....AndroidPhone..IosPhoneChrome..AndroidTablet..IosTablet.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):285
                                              Entropy (8bit):5.225193641540371
                                              Encrypted:false
                                              SSDEEP:6:DsauP1cNwi23mrXgNfrl2KLlpsaT7Q+q2PcNwi23mrXgNfrK+IFUv:D8ZmG1LrTvLZmG23FUv
                                              MD5:77144B9081A4A25916077B9EF51D96EA
                                              SHA1:FDD55EEE6119D99AD40AD8B1B2B9D452F2A41011
                                              SHA-256:EDF406ECEACB787683536B0CCDFF3E2F5D5320DB710719B5B7EBD9A1053CD989
                                              SHA-512:3B2306964C0DE853456C4901A37EBAC50C8DED543E4773C21495CCF2C357691C2382ADC15EE412EFE42E69C067E258DDCA828F10AF218E510D62CF1DD0699E53
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.812 1df8 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db since it was missing..2024/05/22-13:34:56.118 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata\000003.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):990
                                              Entropy (8bit):3.987150377771515
                                              Encrypted:false
                                              SSDEEP:24:G0nYgW29oibtI4+nl6tenBt0dD+CvTEO/KB:LYgf+ibOl+8Beh+q5/C
                                              MD5:D17748B3D2AA8CA697B9159D39D6CF62
                                              SHA1:A7F87788F68E469B8181E04A435D73E41E0308EE
                                              SHA-256:13D4475DB2F6FAF564210156BC2F132076C32B1D53276EE95D98AB072023A99D
                                              SHA-512:02C14D0EB4F57AAF225C1AE3E6461D5541FFF1BA8547520BE85CA2885D744F9B0A712D35D7580F49342BCD0F89F7424465EE7ED1EB013DC4E67F7B3125A424BE
                                              Malicious:false
                                              Preview:.h.6.................__global... .t...................__global... ...w.................44_.....g....................49_........?.................33_......w.E.................32_.......fA.................41_.....^.]D.................21_.......F..................48_......4...................44_........m.................49_.....*.s..................33_.....Wa...................32_......%...................41_.....2...................21_.......E..................48_......&.;.................20_..........................19_..........................9_......-...................18_.....^d.<.................37_.....B....................38_......i*..................39_........D.................3_.....R.PR.................20_......&...................19_.....j.o..................9_......[...................18_.....{-%z.................4_......n.m.................37_.....Q.80.................38_..... C..... .............39_........L...!.............3_........i...".............4_.....

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):16
                                              Entropy (8bit):3.2743974703476995
                                              Encrypted:false
                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                              MD5:46295CAC801E5D4857D09837238A6394
                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                              Malicious:false
                                              Preview:MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata\LOG

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):303
                                              Entropy (8bit):5.207693664593446
                                              Encrypted:false
                                              SSDEEP:6:DsaU1cNwi23mrXgNfrzs52KLlpsatQ+q2PcNwi23mrXgNfrzAdIFUv:DIZmGs9LrVvLZmG9FUv
                                              MD5:900AC28524FCC5CB7A122C4BB1F44874
                                              SHA1:7736E979D310F6F0152A0695FAF3FD6B44F0776A
                                              SHA-256:E1E1956CB53C0FA7796C3087C797F3ACBDFAA7B88521F128C429B5134D96077A
                                              SHA-512:4E3B70F81876792D04E0A31E2194C7F5B9D6AB4F42F30918940F6BEDC5257425B3EAC33F2DE2022016868BE8CAF1EF8B2600C357F1C3B678C298E73512AB64A8
                                              Malicious:false
                                              Preview:2024/05/22-13:34:55.764 1df8 Creating DB C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata since it was missing..2024/05/22-13:34:55.788 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:OpenPGP Secret Key
                                              Category:dropped
                                              Size (bytes):41
                                              Entropy (8bit):4.704993772857998
                                              Encrypted:false
                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                              Malicious:false
                                              Preview:.|.."....leveldb.BytewiseComparator......

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Default\trusted_vault.pb (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):38
                                              Entropy (8bit):4.023471592049354
                                              Encrypted:false
                                              SSDEEP:3:N0DIQVoKy:a8Q+
                                              MD5:3433CCF3E03FC35B634CD0627833B0AD
                                              SHA1:789A43382E88905D6EB739ADA3A8BA8C479EDE02
                                              SHA-256:F7D5893372EDAA08377CB270A99842A9C758B447B7B57C52A7B1158C0C202E6D
                                              SHA-512:21A29F0EF89FEC310701DCAD191EA4AB670EDC0FC161496F7542F707B5B9CE619EB8B709A52073052B0F705D657E03A45BE7560C80909E92AE7D5939CE688E9C
                                              Malicious:false
                                              Preview:..... 2a68348c2ca0c50ad315d43d90f5a986

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GrShaderCache\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GrShaderCache\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0012471779557650352
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GrShaderCache\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GrShaderCache\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GrShaderCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):262512
                                              Entropy (8bit):9.553120663130604E-4
                                              Encrypted:false
                                              SSDEEP:3:LsNlfB5lt:Ls3f5t
                                              MD5:18B49273500281645A0325FEF933B570
                                              SHA1:EAA95E22C52909D3C7B59457912C3D5FBBCCD086
                                              SHA-256:962F358E59FC497CA517B4B27B2DD6EAD5C64C689568EDF2786C12E71B6DF5F8
                                              SHA-512:19D8A04C7EABD0136D08E0408908EED9B391D22390853DAE041C0AC3C1942C8E91C1FC7D8021CC980C20DEC0F44033532EDF7A2962D23026A65B4537EDD9EF63
                                              Malicious:false
                                              Preview:........................................2....w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GraphiteDawnCache\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GraphiteDawnCache\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0012471779557650352
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GraphiteDawnCache\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GraphiteDawnCache\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\GraphiteDawnCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):262512
                                              Entropy (8bit):9.553120663130604E-4
                                              Encrypted:false
                                              SSDEEP:3:LsNl3:Ls33
                                              MD5:C7BF069C347EA5F217CB780C50236A2F
                                              SHA1:6F7F4B952F304B69AA3D8BD09DCA66306AB3D2AE
                                              SHA-256:2A46DDA07AE33443006F665CB01E0B655341EC94C47587C078BAEF1E809C4C69
                                              SHA-512:9BBC0AD45A66DB06FF784630C2738872C28FD926CC23DDDAA4284DFE4AD178FA9145FCFAD1AC47E7BBC72868DD0BFBEB87B4A0499C95A4C59BA1696D12727108
                                              Malicious:false
                                              Preview:.........................................h...w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Last Browser

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):162
                                              Entropy (8bit):3.2705185018123375
                                              Encrypted:false
                                              SSDEEP:3:aoRMlW8g1hOEjlpQlyEXl1lAbl7cAMXl7UlRvlVjlyljlUc/lXlFXlyAlXBl:1MlW8g1UEZ+lX1IbRc9UlR9+ljlX/V0c
                                              MD5:5059DBD083B36503E8AEC7BFFDB1FD48
                                              SHA1:8334A5BFD59E047BA60515D2F9D5C04723D40AEB
                                              SHA-256:95D5CBC90C6261276343642FF78F4CE2685B385370F8172A62BF5D36988718E5
                                              SHA-512:495713D89AD5EFA2E1DA6F31B7E63BF9B4FA00DED66532AB99C50151A4601C224DE6A4DB7C162BD6C8EDBA9C8E3D7830317733E3D1B21FDD82FE5FBB4F4BA832
                                              Malicious:false
                                              Preview:C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.C.l.e.a.r.\.1...1...3...0.\.c.h.r.o.m.i.u.m.\.c.l.e.a.r.b.r.o.w.s.e.r...e.x.e.

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Last Version

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):14
                                              Entropy (8bit):2.41379956460568
                                              Encrypted:false
                                              SSDEEP:3:OVLV7LFcn:OhBFcn
                                              MD5:97799617471BA96FDF65E061EC412615
                                              SHA1:BE54E44397240A2A10220613B9A3C6A5007D8490
                                              SHA-256:2E0DE0A2D0D45D02236C37E897326FA81C598095235B02E73EA8B9D62677A6EE
                                              SHA-512:A709446C28A85A4F06B2E4C016727C7291DB9497A4979A2B5A0CCD2C2E7A9B2FD9189632A5432226B4EFCEDA5D3BBF8464C058F6E320B03577508258252D41F6
                                              Malicious:false
                                              Preview:120.0.6099.199

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Local State (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):937
                                              Entropy (8bit):5.661919794328981
                                              Encrypted:false
                                              SSDEEP:24:YRak7u5rrtl/V1D0CUc44/mpDlxcHwvyik/xBzf2S+JXXg/QonF:YRafLdUb4qHNzeBzuSgXwYoF
                                              MD5:3701D013D40C6A776854EE9641BAD913
                                              SHA1:7DA0B61D15AAA239FD62773E8522E975B43E293A
                                              SHA-256:7463B2988A7C22F76966E428B634330212FC595445ADFDE30653F7F267971D77
                                              SHA-512:5F85494B5BD0D4D36ACCCFA65B819BF4211492048969EA2A4213B18FA88302DE21E64E4303300A3572FB4762FEA2E8F3214F25C0F6EB8C4862C7D6E524B710AA
                                              Malicious:false
                                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"privacy_budget":{"generation":10,"selected":"0"},"profile":{"info_cache":{},"profile_counts_reported":"13360872895082903","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1716399294"},"user_experience_metrics":{"low_entropy_source3":1620,"pseudo_low_entropy_source":659,"stability":{"browser_last_live_timestamp":"13360872894935444","stats_buildtime":"1704223882","stats_version":"120.0.6099.199-64-devel","system_crash_count":0}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Local State~RF6be99c.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):937
                                              Entropy (8bit):5.661919794328981
                                              Encrypted:false
                                              SSDEEP:24:YRak7u5rrtl/V1D0CUc44/mpDlxcHwvyik/xBzf2S+JXXg/QonF:YRafLdUb4qHNzeBzuSgXwYoF
                                              MD5:3701D013D40C6A776854EE9641BAD913
                                              SHA1:7DA0B61D15AAA239FD62773E8522E975B43E293A
                                              SHA-256:7463B2988A7C22F76966E428B634330212FC595445ADFDE30653F7F267971D77
                                              SHA-512:5F85494B5BD0D4D36ACCCFA65B819BF4211492048969EA2A4213B18FA88302DE21E64E4303300A3572FB4762FEA2E8F3214F25C0F6EB8C4862C7D6E524B710AA
                                              Malicious:false
                                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"privacy_budget":{"generation":10,"selected":"0"},"profile":{"info_cache":{},"profile_counts_reported":"13360872895082903","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1716399294"},"user_experience_metrics":{"low_entropy_source3":1620,"pseudo_low_entropy_source":659,"stability":{"browser_last_live_timestamp":"13360872894935444","stats_buildtime":"1704223882","stats_version":"120.0.6099.199-64-devel","system_crash_count":0}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Local State~RF6c1669.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):937
                                              Entropy (8bit):5.661919794328981
                                              Encrypted:false
                                              SSDEEP:24:YRak7u5rrtl/V1D0CUc44/mpDlxcHwvyik/xBzf2S+JXXg/QonF:YRafLdUb4qHNzeBzuSgXwYoF
                                              MD5:3701D013D40C6A776854EE9641BAD913
                                              SHA1:7DA0B61D15AAA239FD62773E8522E975B43E293A
                                              SHA-256:7463B2988A7C22F76966E428B634330212FC595445ADFDE30653F7F267971D77
                                              SHA-512:5F85494B5BD0D4D36ACCCFA65B819BF4211492048969EA2A4213B18FA88302DE21E64E4303300A3572FB4762FEA2E8F3214F25C0F6EB8C4862C7D6E524B710AA
                                              Malicious:false
                                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"privacy_budget":{"generation":10,"selected":"0"},"profile":{"info_cache":{},"profile_counts_reported":"13360872895082903","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1716399294"},"user_experience_metrics":{"low_entropy_source3":1620,"pseudo_low_entropy_source":659,"stability":{"browser_last_live_timestamp":"13360872894935444","stats_buildtime":"1704223882","stats_version":"120.0.6099.199-64-devel","system_crash_count":0}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Local State~RF6c1697.TMP (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):937
                                              Entropy (8bit):5.661919794328981
                                              Encrypted:false
                                              SSDEEP:24:YRak7u5rrtl/V1D0CUc44/mpDlxcHwvyik/xBzf2S+JXXg/QonF:YRafLdUb4qHNzeBzuSgXwYoF
                                              MD5:3701D013D40C6A776854EE9641BAD913
                                              SHA1:7DA0B61D15AAA239FD62773E8522E975B43E293A
                                              SHA-256:7463B2988A7C22F76966E428B634330212FC595445ADFDE30653F7F267971D77
                                              SHA-512:5F85494B5BD0D4D36ACCCFA65B819BF4211492048969EA2A4213B18FA88302DE21E64E4303300A3572FB4762FEA2E8F3214F25C0F6EB8C4862C7D6E524B710AA
                                              Malicious:false
                                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"privacy_budget":{"generation":10,"selected":"0"},"profile":{"info_cache":{},"profile_counts_reported":"13360872895082903","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1716399294"},"user_experience_metrics":{"low_entropy_source3":1620,"pseudo_low_entropy_source":659,"stability":{"browser_last_live_timestamp":"13360872894935444","stats_buildtime":"1704223882","stats_version":"120.0.6099.199-64-devel","system_crash_count":0}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\ShaderCache\data_0

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.01057775872642915
                                              Encrypted:false
                                              SSDEEP:3:MsFl:/F
                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                              Malicious:false
                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\ShaderCache\data_1

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):270336
                                              Entropy (8bit):0.0012471779557650352
                                              Encrypted:false
                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\ShaderCache\data_2

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.011852361981932763
                                              Encrypted:false
                                              SSDEEP:3:MsHlDll:/H
                                              MD5:0962291D6D367570BEE5454721C17E11
                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\ShaderCache\data_3

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):0.012340643231932763
                                              Encrypted:false
                                              SSDEEP:3:MsGl3ll:/y
                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\ShaderCache\index

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                              Category:dropped
                                              Size (bytes):262512
                                              Entropy (8bit):9.47693366977411E-4
                                              Encrypted:false
                                              SSDEEP:3:LsNlrqHz:Ls3m
                                              MD5:F4E199710985F5331CFF206F72B5F428
                                              SHA1:B2BD92A3FDB0C59AFD13B2D45B9081D95E4964E4
                                              SHA-256:B75BED9ACFDE29DE6D5284BA9447888A1CA05ED761C1F78799C8D5633F5B2C3D
                                              SHA-512:7D91FDA193CE4B68B1F435FB8C45118DB7CA63B66A7815AE3C66A1E356E5066059E5C6DE10F0D0896F81B9D573C98940FAF16A8DA763EF991F49746D78ED77DF
                                              Malicious:false
                                              Preview:.........................................7..w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\Variations

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):85
                                              Entropy (8bit):4.3488360343066725
                                              Encrypted:false
                                              SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQan:YQ3Kq9X0dMgAEiLIM
                                              MD5:BC6142469CD7DADF107BE9AD87EA4753
                                              SHA1:72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
                                              SHA-256:B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
                                              SHA-512:47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
                                              Malicious:false
                                              Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\a0d62ee2-df6d-467c-87aa-cb5593f71d74.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2769
                                              Entropy (8bit):5.353495227099254
                                              Encrypted:false
                                              SSDEEP:48:YrglL0vB643fLdUb4qH5z3JCYXylVotougEG5KHHB+ndxvp0+6vBzuPeg2OMooJ7:PlLC6YfJiB5+DotoQoKnB2+LvJz+toJ7
                                              MD5:206F95716340629BE907CD3234896BBD
                                              SHA1:65945065B9F2BCF0E1B8F745E2957838129CACCA
                                              SHA-256:F5459430CDB90B9B7305BD6B01E1FEBD26477A7B3DD23250EC3BB54A62C2C7A1
                                              SHA-512:A8B2177B8E3D567FCC4A76E4C4D3EB7797EE100CCB8ADA38741DAA207181A1381FE429A22C341D69E86B1AC22A8C6E1E20A8129FBCB5CE02A1BF72B12FFEC6A5
                                              Malicious:false
                                              Preview:{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledF-5","shortcut_migration_version":"120.0.6099.199"},"chrome_labs_activation_threshold":8,"chrome_labs_new_badge_dict":{"chrome-refresh-2023":-1,"tab-groups-save":-1},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.71639930410499e+12,"network":1.71639249124e+12,"ticks":7071192319.0,"uncertainty":10349469.0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\c105f5d1-fe52-4dcd-8b35-fd64df211ddb.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):937
                                              Entropy (8bit):5.661919794328981
                                              Encrypted:false
                                              SSDEEP:24:YRak7u5rrtl/V1D0CUc44/mpDlxcHwvyik/xBzf2S+JXXg/QonF:YRafLdUb4qHNzeBzuSgXwYoF
                                              MD5:3701D013D40C6A776854EE9641BAD913
                                              SHA1:7DA0B61D15AAA239FD62773E8522E975B43E293A
                                              SHA-256:7463B2988A7C22F76966E428B634330212FC595445ADFDE30653F7F267971D77
                                              SHA-512:5F85494B5BD0D4D36ACCCFA65B819BF4211492048969EA2A4213B18FA88302DE21E64E4303300A3572FB4762FEA2E8F3214F25C0F6EB8C4862C7D6E524B710AA
                                              Malicious:false
                                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9G3a/FeSIT7Lyj6OGBkKHEAAAABoAAABDAGwAZQBhAHIAQgByAG8AdwBzAGUAcgAAABBmAAAAAQAAIAAAAHzHyyPvT5KgabwnDqK6qpr5Biz5VLHuzFD4MSwljo1AAAAAAA6AAAAAAgAAIAAAABQUnU62RtlknujE9II0MsI6+Eq6Ou0JsgVQ5NHyhdXjMAAAAGjc9+XhQW1w2kBpqGGGEYuEph93co8XkNZln428xjLARyL2snPQOWJ9zt1RISwgqkAAAACOtVBtn1LQU2hhpQNvi9ctdY09R34ospY1zfef9aS5teyAC5j6BjUKZ6q9TcKO0u9TdG8NkeFsUK3AY72+2c49"},"privacy_budget":{"generation":10,"selected":"0"},"profile":{"info_cache":{},"profile_counts_reported":"13360872895082903","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1716399294"},"user_experience_metrics":{"low_entropy_source3":1620,"pseudo_low_entropy_source":659,"stability":{"browser_last_live_timestamp":"13360872894935444","stats_buildtime":"1704223882","stats_version":"120.0.6099.199-64-devel","system_crash_count":0}}}

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\first_party_sets.db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 1, database pages 12, cookie 0xa, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):49152
                                              Entropy (8bit):0.515971744409012
                                              Encrypted:false
                                              SSDEEP:24:TLizc4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:Tm/IHRH34kWqB1kQnjhHmr6ITmUrxY
                                              MD5:0B39FC489F2984543430256D1604CCBF
                                              SHA1:E352C9E897B43E4E89A83908EBB1B702934C22D8
                                              SHA-256:F4BD97942C25585CD4E0EEAC40F80549568D386C1E39B9F660C50930C4E3F573
                                              SHA-512:C70BE1808486222CEAA08C1B292F8C516861789221852CC2C3942427E9E41FB115ABB06D6A40AA3B9F55856024A09AE1F69739FC4A1DC359729C372FA6319020
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n.......\..g.................C.\......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\ClearBrowser\User Data\segmentation_platform\ukm_db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3043002, file counter 6, database pages 7, cookie 0x6, schema 4, UTF-8, version-valid-for 6
                                              Category:dropped
                                              Size (bytes):28672
                                              Entropy (8bit):0.35701249945369085
                                              Encrypted:false
                                              SSDEEP:24:TL2ANrCuoxbGduhr2fk05b53HxOSRtK0J4ApCu:TTC4QB2zbBxx
                                              MD5:6765417420B2B12BA5CF7ECB14A4762B
                                              SHA1:BF6FD984DB91B6265A2DEAA1025C405DB9794621
                                              SHA-256:B49FA26240B39CF93263D556574861876F0F7477AE0AF5D0D484856AC5E59723
                                              SHA-512:D3CB8CEAFB8CB8CAA327299EE6B69E164F5A26C570013911EAB97D31DA4EBA49A91CC746156E5AFF75518B366E022C9A56FA7C3D7D45FEAD103733076D4EDCDE
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................n..................x..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Clear\app_profile.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):2084
                                              Entropy (8bit):5.2895859034321235
                                              Encrypted:false
                                              SSDEEP:48:GY2xmH0YyJsrVUWXiuk7plUe9KDXGa5Hu3dAv:Gn1JsJtSuk7bVV3uv
                                              MD5:1EB5DCE6D535354DC532F0C1A3E01699
                                              SHA1:3DBA4D661D8ACEACEA9EF04AEA386C3BF8FD1D9C
                                              SHA-256:8BB1B029EE323CA99DB8FFF226A09AFA8264B63A5BB500B2533B0156A6086822
                                              SHA-512:6654C9B6A062737ADCE272EAE29E1CE6627E32027F33251B364E1883C1F1F25B6562F89CAA4BB62446027932BDF9CC80024C16F7C6C0D4941FAFDDD492EB2445
                                              Malicious:false
                                              Preview:{.. "Id": null,.. "ThankYouPageUrl": "https://clearbar.app/rd2/?id=202336Ly9hcmNhZGV0YWIuY29t&guid={guid}&ext.id={profile.BrandName}&ext.version={app.version}",.. "HomePageUrl": "chrome://newtab/",.. "FirstRunUrl": "https://clearbar.app/rd2/?id=104162Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "PostUpdateUrl": null,.. "SearchUrl": "https://search.clearbar.app/crx/search.php?guid={guid}&q={searchTerms}&action={searchAction}",.. "SuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}&output=json",.. "NewtabUrl": null,.. "ChromiumSuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}",.. "UpdateUrl": null,.. "UnInstallUrl": "https://clearbar.app/rd2/?id=215388Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "ApplicationName": "Clear",.. "InstallerFileName": "Clear-TemplateSearch.b5003.SK048.ed.exe",.. "FeatureUrls": {.. "weather": "https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203541_{user.InstallTime|format_mmddyy}",.. "app-icon": "https://search.yahoo.com?fr=

                                              C:\Users\user\AppData\Local\Clear\user_config.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):687
                                              Entropy (8bit):5.133622957405445
                                              Encrypted:false
                                              SSDEEP:12:oNi0a7yWsHjEztSRIXwfbaEm93Au7DPFjVam7RX6hW/+tI1Jj7E6p8vpd2iEW0dq:oNs7QEBQQ2g93AQV1xT/+WD/ED2iEW0Q
                                              MD5:74147E7D3739C41C338B28ACC9CC217D
                                              SHA1:5FB314F5530545792EEEEBEBB419F5B5CDD50C01
                                              SHA-256:07D812F9B509A8615FB3E9C1DC969F7F62973F762834D4CFD97F71D953D3A70C
                                              SHA-512:EAAEC2F22457381F2BD4EB18745577AB264F71B4D1A45A425DB638963627AA777D18A8C4844A0B37145E81B350C254AB8C02EF9CB0D64B28B97FCF5EA1F896DD
                                              Malicious:false
                                              Preview:{.. "InstallGuid": "173f77d4-1d21-45bb-8074-7fb83cfed713",.. "InstallTime": "2024-05-22T13:34:49.8041839-04:00",.. "LastLocation": null,.. "ShowSnippingTool": false,.. "ShowRecycleBin": false,.. "ShowDownloadFolder": false,.. "ShowAppNavigation": true,.. "UpdatePerformed": false,.. "PingTime": null,.. "LightMode": false,.. "ThemeColor": null,.. "InstallDir": "C:\\Users\\user\\AppData\\Local\\Programs\\Clear",.. "ShowMenuTools": true,.. "ShowMenuApps": true,.. "ShowMenuTopSites": true,.. "LastWeatherNotification": null,.. "Settings": {.. "AutomaticUpdate": true,.. "LaunchOnStartUp": true,.. "DefaultTheme": "Auto",.. "TemperatureUnit": "F".. }..}

                                              C:\Users\user\AppData\Local\Clear\user_database.db

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:data
                                              Category:modified
                                              Size (bytes):32768
                                              Entropy (8bit):0.283074909608699
                                              Encrypted:false
                                              SSDEEP:12:jyZeCunSv1NvahyVhSwso4vkk8RuAVfrOUuQccogDvOS7homY:eZeCqSnd6vkk87frORwzldJY
                                              MD5:64C75E61CCD426D1EA766F92D8ADA307
                                              SHA1:1152175C2CFFAFF36AEED39313CDAD7E942FB654
                                              SHA-256:0975E45B64F8044258033C114C760FC6321540C9FFE4D884F55CCEC25989552C
                                              SHA-512:3B8D5C01D0DEF404C84AB856F4B8340894AA37344FBE266AECC49A190AC12726F4DF26D7303DA361AD0B2911D1897303B0A6516211E123136A5ED8652E7043C1
                                              Malicious:false
                                              Preview:............................ ...** This is a LiteDB file **............|.z..............<............................................................................................................topsites...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Clear.exe.log

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:CSV text
                                              Category:dropped
                                              Size (bytes):3953
                                              Entropy (8bit):5.356679965047048
                                              Encrypted:false
                                              SSDEEP:96:iqbYqGSI6ou/fmOYqSqtzHeqKkoZwmj6mqnqCqZ40q1o/qc0q2iwqgRLKD:iqbYqGcn/uHqXtzHeqKkoZwmjNqnqCqB
                                              MD5:6C87B5B2C55188FE1E6ED784A816BC20
                                              SHA1:A87B31E96419280A95903FEF040B63C56439FCB5
                                              SHA-256:F6C759C56B78997B0DFAB7200F9090FC1AC087588C9468B86FB7BADA3BDAB7F9
                                              SHA-512:72D48D8DBBBA59F348D248BCF3E5A6D729C28DFE0CB69A36C84715C5385E2D7E96FF428CD5DC4A7855CD6B34874AC92689A5DCF62FC0402AE8A633C615A1495B
                                              Malicious:false
                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):49120
                                              Entropy (8bit):0.0017331682157558962
                                              Encrypted:false
                                              SSDEEP:3:Ztt:T
                                              MD5:0392ADA071EB68355BED625D8F9695F3
                                              SHA1:777253141235B6C6AC92E17E297A1482E82252CC
                                              SHA-256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
                                              SHA-512:EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
                                              Malicious:false
                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\120.0.6099.199.manifest (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):228
                                              Entropy (8bit):4.890604933532555
                                              Encrypted:false
                                              SSDEEP:6:KdhlRu9TbX+A8/5RFYpQPFc7XkfhPFc7XX0CdiYCMfrA1G:KLuVA5cpQ+70fh+7n07v9G
                                              MD5:D82A50C6750AF1EA0480E648E9B7EC97
                                              SHA1:64B84CDBABA77625C95C29249F872BF72BCE8081
                                              SHA-256:343EEDBE46C18B0ECCD53B5760368A599BE3BAC084FCE25CD693947B3BD08901
                                              SHA-512:6520CCE1B30D1C8FF151AF20BB3AA3CDB104D0F3CA16D9736FE6642051694D88258CC3F9607710AC386B93EFF4FDA8533E0C41A335932613C98D78B14E9667A7
                                              Malicious:false
                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='120.0.6099.199'.. version='120.0.6099.199'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\First Run (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):8
                                              Entropy (8bit):3.0
                                              Encrypted:false
                                              SSDEEP:3:Iv:S
                                              MD5:5206EB9697BF5F2978F399F4869CBF18
                                              SHA1:4D6AE0E8CCEF787681E0F6C9E912EA41CDFFB758
                                              SHA-256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
                                              SHA-512:634535B9A6AF54D3B78A85F8F473E09BEA0D2C47C8E97B84B5F879DC1E7E9F387C81A80D1221A04C26AD7AFBF14D8DBCFE22430BF3EFBCEAE18EDA45E964DBB3
                                              Malicious:false
                                              Preview:krome ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\is-3MPE6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8254
                                              Entropy (8bit):6.795641289553097
                                              Encrypted:false
                                              SSDEEP:192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
                                              MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                              SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                              SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                              SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                              Malicious:false
                                              Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\is-DUT82.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):238
                                              Entropy (8bit):4.824253848576346
                                              Encrypted:false
                                              SSDEEP:6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
                                              MD5:442699C95B20A60470421C6A4D29960F
                                              SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                              SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                              SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                              Malicious:false
                                              Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\manifest.json (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):238
                                              Entropy (8bit):4.824253848576346
                                              Encrypted:false
                                              SSDEEP:6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
                                              MD5:442699C95B20A60470421C6A4D29960F
                                              SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                              SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                              SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                              Malicious:false
                                              Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\MEIPreload\preloaded_data.pb (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8254
                                              Entropy (8bit):6.795641289553097
                                              Encrypted:false
                                              SSDEEP:192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
                                              MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                              SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                              SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                              SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                              Malicious:false
                                              Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):215236096
                                              Entropy (8bit):6.651476064795753
                                              Encrypted:false
                                              SSDEEP:1572864:TcN7F2PztYM8GteDH+eseBTVd4LLmIyptaC5h3wERrx47:g6WHoItrx
                                              MD5:50668F17584CCF580240E67CB56EEF3A
                                              SHA1:EBD9B0E32E70296EB9B9AEA33480AE3D0CECF2B7
                                              SHA-256:441590E714D6715DD9DCE7C066029E8F0610B1B62A31D3EEDE5517D2C3D67468
                                              SHA-512:9F080CDFE1708289A9E5305A7A831B80E3C29E26888FDFC530D3552848110123C8815A11EE4B278F5BC0E5443B24B6B9407687EE07E32E798E06DFA448C820B2
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....h...................................................@0...........`A........................................o"e.....~#e.h....`.......@..."F..........P......@.W.8...................P.W.(...P...@...........p8e.....p.d.`....................text....g.......h.................. ..`.rdata...y.......y..n..............@..@.data...(.f..0j.......j.............@....pdata..."F..@...$F...t.............@..@.00cfg..0....p......................@..@.gxfg....C.......D..................@..@.retplne.............:...................rodata..............<.............. ..`.tls.................N..............@...CPADinfo8............T..............@...LZMADEC...... .......V.............. ..`_RDATA.......@.......h..............@..@malloc_hV....P.......j.............. ..`.rsrc........`.......p..............@..@.reloc.......P.......V..............@..B................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_100_percent.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):686222
                                              Entropy (8bit):7.962928283524176
                                              Encrypted:false
                                              SSDEEP:12288:sI3HXfJD6XIfzgsz5B0GDJQrnKs8SNP+QSsSilEOXNzg0Vc+gIXPdXoO0TehEr2:L33B6KzEEmPLSdOXNzg05gUPdXoO0TO5
                                              MD5:48321D24D66927A1D1ECC339E1845259
                                              SHA1:3668BEA05AC282130D7B1BF5CCF4A2CE303581D0
                                              SHA-256:D02726B9814E34DD40C470DB848CDD8B2BE69A2E25766CF9EB2F82AE25B08004
                                              SHA-512:9C9D45F7C2F309519582A9F0D6A116021C37D28A2EBDB31F1F6DC5FECF836D2E714D52D015AA9FEAAE692798AB42B6C1C60D715C9DB442733E10D0A675D9E8CE
                                              Malicious:false
                                              Preview:..........L............... ...........@..........;M....;.....;$....;.....;.....;b....;.....;!....;x....;....;5....;.....;....;@....;.....;....;L....;.....;.....;.....;.....;&....;l....;.....;N....;.....;.....;.....;.....;.....;.....;.....;.....;.....;H....;.....;.....;g....;.....;.....;.....;s....;@....;.....;f%...;.%...;`&...;.'...;.'...;A(...;.1...;.:...;.N...;.b...;.c...;.e...;yg...;.j...;.q...;.x...;.....;H....;.....;.....;/....;~....;*....;.....;.....;,....;.....;.....;.....;.....;:....;8....;.....;.....;.....;D....;.....;.....;."...;a+...;.3...;79...;.A...;.B...;.`...;3z...;.....;d....;=....;.....;Y....;.....;.%...;W8...;Ia...;.u...;t....;!....;O....;*....;.....;.....<.....<E....<.....<."...<.,...<.4...<y<...<.D...<.I...<vU...<._...<.c...<_h...<}m...<.~...<.....<.....<o....<r....<&....<R....<.....<S....<.....<.(...<v7...<;E...<'O...<!V.. <(]..!<3r.."<...#<:...)<....*<"...+<#...,<...;<7...<<*...=<...><...?<....@<....A<....B<&...C<....D<....E<....F<....G<....J<....K<Y...L<5$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_200_percent.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1048078
                                              Entropy (8bit):7.950396437745758
                                              Encrypted:false
                                              SSDEEP:24576:A3RBFXw4QmmibkFR8+mZZSrHumegvQtf05UwvdrPbae6edhOLoe4:A3FX3QmNbkFRJm6RhQd05JvdvjrOS
                                              MD5:102C7F476668759F051DCC36C61A934E
                                              SHA1:25FA1A726D596E9A25CE500A49D1E9CDC7134791
                                              SHA-256:E0EAAF4E8F1AD3E024387FDAF46FE67DA28B751FE18F473E5B6D968E067D5B07
                                              SHA-512:BD68480E4F46574309406DDC5F6862B92070026CC5E468C38906F8AD6A265016B3C0E3B3C9981473807131469B3E5621E3A2A7BEAA64D71974FB2A99EE5C1D6F
                                              Malicious:false
                                              Preview:..........L.........+...........|.....#..........;.....;x....;....;d....;....;P....;.....;'....;.....;.....;_....;.....;-....;.....;.....;W....;.....;.....;.....;3....;Z....;.....;.....;-....;.....;}....;.4...;.R...;3g...;A|...;.~...;.~...;.....;|....;.....;.....;.....; ....;....;#....;.....;t....;M....;....;.....;C....;.....;.....;....;R....;.....;.....;k....;.4...;.6...;e8...;.:...;7B...;.R...;uc...;.t...;.....;k....;.....;.....;3....;.....;!....;W....;@....;.....;./...;.B...;BR...;.e...;zy...;&....;.....;?....;.....;E....;.....;.$...;.8...;.P...;._...;Mx...;I{...;=....;.....;=....;.....;.....;.....;.0...;fB...;}^...;?q...;=....;.....;.....;9....;s....;Z....;.....;.....<=-...<.;...<.Q...<O\...<Pf...<.m...<.v...<M~...<.....<6....<.....<L....<....</....<.....<.....<.+...<.X...<.y...<.....<.....<.....<.....<.&...<|D...<.b...<.}...<`....<.... <...!<n..."<5B..#<.B..)<+D..*<.f..+<...,<9...;<....<<....=</...><...?<)...@<....A<....B<g...C<8...D<u...E<.B..F<.F..G<.L..J<.T..K<.a..L<.n

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_elf.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1253888
                                              Entropy (8bit):6.461722096170348
                                              Encrypted:false
                                              SSDEEP:12288:Q7/pC5+HOAR1bhQ7MIo1s8LDH7vGO/5MZI5fwS3Mh6gmCfO6J5qO2fj/MEwvoMA5:6C0OAR167MPG+9tD3M4af9n2ov42Jq
                                              MD5:417E6D505060EA7B80F3EEA2FB37FC73
                                              SHA1:8FF255320737334ABF8EE4BBCFFA005E4CF5C594
                                              SHA-256:52539B62716646F3E0331FCD26B70F66AFC65D1CB7A60A0CA42947660DF626FA
                                              SHA-512:E5455F8DFF85661965B52F197644911EC5946925C68B982DC24A9CE15F0FCC405E316F66255283906DC5DB22B2B4761FD0ECAABC14BA8203AB8C7E0EFD074349
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....|...................................................`............`A................................................=...P....0..p.......\............@..(...L...8................... ...(.......@...........X...............................text....z.......|.................. ..`.rdata..............................@..@.data.......P.......8..............@....pdata..\............8..............@..@.00cfg..0...........................@..@.crthunk............................@..@.gxfg....-..........................@..@.retplne.................................tls....z...........................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...p....0......................@..@.reloc..(....@......................@..B................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_proxy.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1098816
                                              Entropy (8bit):6.491648618887458
                                              Encrypted:false
                                              SSDEEP:12288:nsyLEwmUplo3ddJbTcXnBe1V83nHAu6ujLuxksC5Drkw/7LC7IMA+nkMoKl2zEgd:8wmUplyJbTcXHXgu6aeC5Dziz5l2AgPV
                                              MD5:2AA4D6714A782F061E712E814C5F4AC0
                                              SHA1:A069BD2FC63205EAD2299A0E5B8B5C64D7B0DEBF
                                              SHA-256:54EA18533A93F893E2C3383420CA717D1DBD3911EA7A692EA81D36D070931297
                                              SHA-512:F11A5C076ADF19AD2EC010D94D639BE11E40B2342A66DFA0B0C1B14DBFF20D010DA1FF0DBC325347EBF5BF42F99BB3FBD0DF163413995559AB8CB2159257F8EB
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 4%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."......v... ......p|.........@.....................................2....`.........................................@O..U....O...................u......@(..........\D......................@C..(.......@...........8U...............................text....u.......v.................. ..`.rdata...`.......b...z..............@..@.data...0...........................@....pdata...u.......v..................@..@.00cfg..0.... .......J..............@..@.gxfg....)...0...*...L..............@..@.retplne.....`.......v...................tls.........p.......x..............@..._RDATA...............z..............@..@.rsrc................|..............@..@.reloc..............................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\chrome_pwa_launcher.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392640
                                              Entropy (8bit):6.30352361371339
                                              Encrypted:false
                                              SSDEEP:12288:yUw+QiUdKRzHqUnFsyLhzzkfdgUaFnYKNYWlw0BkVextGVchM0+nkWo4H2nIQRU:WxdKRzHps2hIdgUa1Y+YskVDnH2nVR
                                              MD5:6F935C43F801B3132135A84519A72A65
                                              SHA1:0CF33267EC120BFAFD98CCDC7C962EE4CAFC14FB
                                              SHA-256:D157D1EFAD3C6B8D264F7568B7BED1649A742BEFE412EB7D00DC4D83FAC3CE8E
                                              SHA-512:F50A347C62867CA28A85B6B975B4519494D12A20A6659F06C0F3E6A132878A104042C2D80C8804FC5FFD55878F1E62573BA69B6F55F05B1AC1CE16C3C363ADDE
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........f................@..........................................`.............................................\............0...&... ..hy...........`..p...............................(.......@........... ...`............................text...v........................... ..`.rdata..<...........................@..@.data........p.......J..............@....pdata..hy... ...z...B..............@..@.00cfg..0...........................@..@.gxfg...@+.......,..................@..@.retplne.................................tls....z...........................@...LZMADEC............................. ..`_RDATA....... ......................@..@.rsrc....&...0...(..................@..@.reloc..p....`.......*..............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clear.native-manifest.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:JSON data
                                              Category:modified
                                              Size (bytes):313
                                              Entropy (8bit):4.883435693401176
                                              Encrypted:false
                                              SSDEEP:6:YWIeWe4rL2RHJ0tWD+vkDrX61RETtV2lMLFZ+WPVqa3CiETdn:YYPRHJnRX6jETtVUMLzTtqayiER
                                              MD5:008DD1A96D7742761999DA5BB263C7EE
                                              SHA1:B721C6AA976D0D41D1E57403902F7B3C56C312C9
                                              SHA-256:87E712ADF216204C8DD054BD87B2AE1C684CF874C89ED13B55D809D7C5DCEACA
                                              SHA-512:2116533D9E6A949CE761564C3E33BF95EF9E1BBF451DE05B3AA59EF1789380EE2071F58AE35A650D648B1C807676C0CA11172B88E902E52521763D95C53B66A8
                                              Malicious:false
                                              Preview:{"name":"com.clear.application","description":"Clear Extension Host","path":"C:\\Users\\user\\AppData\\Local\\Programs\\Clear\\1.1.3.0\\Clear.Remoting.Native.exe","type":"stdio","allowed_origins":["chrome-extension://lhgbhkaddoclgompehjgnoabldpmpkno/","chrome-extension://ongdnllcjkgccaaeenpnccdmgnoakclk/"]}

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):2166320
                                              Entropy (8bit):6.433313872060691
                                              Encrypted:false
                                              SSDEEP:24576:8yZ8ayC4hcjNOeIncxogEQI+gUeHJ5Isanvehh4rjCh1VDH:8ishcjNkcusI+0Gsavi1t
                                              MD5:973083D0D50F0C6369162207CA811C69
                                              SHA1:76D54C4BAC7FDABEA111571DB3F6B6E9AC170986
                                              SHA-256:93F34E1BF6B0E90C52F7C283A5DF793C6DA7F4C87BD0F7CCB664F751822F5426
                                              SHA-512:C608B888920E0F210D309FC4F5F57F96D0327E366CF926E8A921FDB656D0882009602EA378ABE2D1480142362FD23002034CD7F10449B2B301DDC543FF5AB4C6
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."...... .....................@............................. ".......!...`.................................................\...d........ ............ .0(....!. ......8.......................(....A..@...............8...(...`....................text............ .................. ..`.rdata......0.......$..............@..@.data...8...........................@....pdata..............................@..@.00cfg..0....@.......f..............@..@.gxfg...0/...P...0...h..............@..@.retplne.................................tls....!...........................@...CPADinfo8...........................@..._RDATA..............................@..@.rsrc.... ......."..................@..@.reloc.. ....!..".... .............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\elevation_service.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1649752
                                              Entropy (8bit):6.513026085681496
                                              Encrypted:false
                                              SSDEEP:24576:xH/txYCfurhloURMmoDJrVVgOBGSWAUFWonZZZs50bF/Z:lUCfu9lbir1VVTBG6U5/1bX
                                              MD5:971F982664399F305E11A44A7F2E7CEA
                                              SHA1:0480BF32029151C8759F9183E61507F205FA7D9B
                                              SHA-256:88BB3A6653278E6613782CE6444A7D0A20B0EDE964D0BCA554BB186654AE1873
                                              SHA-512:67FBD59F37789D407520E78DF9FB911E98314678EC3AAF7EA46E5B6312468A61E54A8508F7DBDF8401C4083847C0CE0D15DABD0E6DE2DA35936B79C3C05A8BE3
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 4%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........L.................@.............................@......=.....`.........................................`W..Z....W..........8...............X(... .......F.......................D..(...P...@............`...............................text............................... ..`.rdata...D.......F..................@..@.data....... ......................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...8...........................@..@.reloc....... ......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\icudtl.dat (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):10717392
                                              Entropy (8bit):6.282534560973548
                                              Encrypted:false
                                              SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                              MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                              SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                              SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                              SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                              Malicious:false
                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-4C1O9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):215236096
                                              Entropy (8bit):6.651476064795753
                                              Encrypted:false
                                              SSDEEP:1572864:TcN7F2PztYM8GteDH+eseBTVd4LLmIyptaC5h3wERrx47:g6WHoItrx
                                              MD5:50668F17584CCF580240E67CB56EEF3A
                                              SHA1:EBD9B0E32E70296EB9B9AEA33480AE3D0CECF2B7
                                              SHA-256:441590E714D6715DD9DCE7C066029E8F0610B1B62A31D3EEDE5517D2C3D67468
                                              SHA-512:9F080CDFE1708289A9E5305A7A831B80E3C29E26888FDFC530D3552848110123C8815A11EE4B278F5BC0E5443B24B6B9407687EE07E32E798E06DFA448C820B2
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....h...................................................@0...........`A........................................o"e.....~#e.h....`.......@..."F..........P......@.W.8...................P.W.(...P...@...........p8e.....p.d.`....................text....g.......h.................. ..`.rdata...y.......y..n..............@..@.data...(.f..0j.......j.............@....pdata..."F..@...$F...t.............@..@.00cfg..0....p......................@..@.gxfg....C.......D..................@..@.retplne.............:...................rodata..............<.............. ..`.tls.................N..............@...CPADinfo8............T..............@...LZMADEC...... .......V.............. ..`_RDATA.......@.......h..............@..@malloc_hV....P.......j.............. ..`.rsrc........`.......p..............@..@.reloc.......P.......V..............@..B................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-4P04C.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):10717392
                                              Entropy (8bit):6.282534560973548
                                              Encrypted:false
                                              SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                              MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                              SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                              SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                              SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                              Malicious:false
                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-63952.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):2166320
                                              Entropy (8bit):6.433313872060691
                                              Encrypted:false
                                              SSDEEP:24576:8yZ8ayC4hcjNOeIncxogEQI+gUeHJ5Isanvehh4rjCh1VDH:8ishcjNkcusI+0Gsavi1t
                                              MD5:973083D0D50F0C6369162207CA811C69
                                              SHA1:76D54C4BAC7FDABEA111571DB3F6B6E9AC170986
                                              SHA-256:93F34E1BF6B0E90C52F7C283A5DF793C6DA7F4C87BD0F7CCB664F751822F5426
                                              SHA-512:C608B888920E0F210D309FC4F5F57F96D0327E366CF926E8A921FDB656D0882009602EA378ABE2D1480142362FD23002034CD7F10449B2B301DDC543FF5AB4C6
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."...... .....................@............................. ".......!...`.................................................\...d........ ............ .0(....!. ......8.......................(....A..@...............8...(...`....................text............ .................. ..`.rdata......0.......$..............@..@.data...8...........................@....pdata..............................@..@.00cfg..0....@.......f..............@..@.gxfg...0/...P...0...h..............@..@.retplne.................................tls....!...........................@...CPADinfo8...........................@..._RDATA..............................@..@.rsrc.... ......."..................@..@.reloc.. ....!..".... .............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-7DLNC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1098816
                                              Entropy (8bit):6.491648618887458
                                              Encrypted:false
                                              SSDEEP:12288:nsyLEwmUplo3ddJbTcXnBe1V83nHAu6ujLuxksC5Drkw/7LC7IMA+nkMoKl2zEgd:8wmUplyJbTcXHXgu6aeC5Dziz5l2AgPV
                                              MD5:2AA4D6714A782F061E712E814C5F4AC0
                                              SHA1:A069BD2FC63205EAD2299A0E5B8B5C64D7B0DEBF
                                              SHA-256:54EA18533A93F893E2C3383420CA717D1DBD3911EA7A692EA81D36D070931297
                                              SHA-512:F11A5C076ADF19AD2EC010D94D639BE11E40B2342A66DFA0B0C1B14DBFF20D010DA1FF0DBC325347EBF5BF42F99BB3FBD0DF163413995559AB8CB2159257F8EB
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 4%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."......v... ......p|.........@.....................................2....`.........................................@O..U....O...................u......@(..........\D......................@C..(.......@...........8U...............................text....u.......v.................. ..`.rdata...`.......b...z..............@..@.data...0...........................@....pdata...u.......v..................@..@.00cfg..0.... .......J..............@..@.gxfg....)...0...*...L..............@..@.retplne.....`.......v...................tls.........p.......x..............@..._RDATA...............z..............@..@.rsrc................|..............@..@.reloc..............................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-988PC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):4971
                                              Entropy (8bit):4.688630860344496
                                              Encrypted:false
                                              SSDEEP:96:RhtkEWUOxdpjY3b+hZVJT9hqyybfmvtJT9lyEWqm5:RXFW7Kr+Lt7mkAxqC
                                              MD5:AE97F42BA3F28093353A1A8DE8D433D7
                                              SHA1:948F5A4A3EA43F95A42D4406F4BC6C987F6CD263
                                              SHA-256:7814CFF2B40FAA7CFF62F304EB3D5554A943E57A4DE2EA3C808C8622166A9F0A
                                              SHA-512:093D0759BAE618FC58A53254D2059432B0FB39149FEB5AC614DA84D6A21ED513972A213B8F799EAB903E8EA6B762E9174C125C7CF5CB0A310F1076CD6FD17B30
                                              Malicious:false
                                              Preview:{.. "homepage": "chrome://newtab/",.. "browser": {.. "check_default_browser": false.. },.. "distribution": {.. "skip_first_run_ui": true,.. "welcome_page_on_os_upgrade_enabled": false,.. "suppress_first_run_bubble": true,.. "suppress_first_run_default_browser_prompt": true,.. "do_not_create_desktop_shortcut": true,.. "do_not_create_quick_launch_shortcut": true,.. "make_chrome_default": false,.. "make_chrome_default_for_user": false,.. "import_autofill_form_data": false,.. "import_bookmarks": true,.. "import_history": true,.. "import_saved_passwords": false,.. "import_home_page": false,.. "import_search_engine": false.. },.. "sync_promo": {.. "show_on_first_run_allowed": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9R8D9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392640
                                              Entropy (8bit):6.30352361371339
                                              Encrypted:false
                                              SSDEEP:12288:yUw+QiUdKRzHqUnFsyLhzzkfdgUaFnYKNYWlw0BkVextGVchM0+nkWo4H2nIQRU:WxdKRzHps2hIdgUa1Y+YskVDnH2nVR
                                              MD5:6F935C43F801B3132135A84519A72A65
                                              SHA1:0CF33267EC120BFAFD98CCDC7C962EE4CAFC14FB
                                              SHA-256:D157D1EFAD3C6B8D264F7568B7BED1649A742BEFE412EB7D00DC4D83FAC3CE8E
                                              SHA-512:F50A347C62867CA28A85B6B975B4519494D12A20A6659F06C0F3E6A132878A104042C2D80C8804FC5FFD55878F1E62573BA69B6F55F05B1AC1CE16C3C363ADDE
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........f................@..........................................`.............................................\............0...&... ..hy...........`..p...............................(.......@........... ...`............................text...v........................... ..`.rdata..<...........................@..@.data........p.......J..............@....pdata..hy... ...z...B..............@..@.00cfg..0...........................@..@.gxfg...@+.......,..................@..@.retplne.................................tls....z...........................@...LZMADEC............................. ..`_RDATA....... ......................@..@.rsrc....&...0...(..................@..@.reloc..p....`.......*..............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-9V0UG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):7727616
                                              Entropy (8bit):6.443214904498888
                                              Encrypted:false
                                              SSDEEP:49152:OuKKDREU7DOVBlaYVdun5/KWyLkT50Q0MEtTk4xikRGLUGO3xUeP6ZfDZe/22e60:XPV5/KQ0tSL3c7OfiCXOFcSeRXm3lJA
                                              MD5:9C358F1191CF2D4E77A90FB2AB57D9BE
                                              SHA1:D94FC8A441AB565407CAEAAF2F05C381A550FAF6
                                              SHA-256:BEBE06A370169EC96EE868C9DF34CBDA2C97632F4F8935097B8D777089CE3425
                                              SHA-512:8B6FD15DCE4A6117D9C4D11A93995C8CF0DB34A320E7277CB37C9252897F55459438C0FCF7D5767A0D62CA8C7331276846BA5763FDBC7BEA63946F0447DC9B7C
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." ......Y..,.......aV.......................................v...........`A.........................................[m.....S8n.d.....v......0s..T............v.......l.8.....................l.(.....Y.@...........H=n......Zm.@....................text...%.Y.......Y................. ..`.rdata...:....Y..<....Y.............@..@.data.........o.......n.............@....pdata...T...0s..V....r.............@..@.00cfg..8.....u.......t.............@..@.gxfg....,....u.......t.............@..@.retplne......u.......u..................tls....B.....u.......u.............@..._RDATA........u.......u.............@..@.rsrc.........v.......u.............@..@.reloc........v.......u.............@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-DPM2J.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):8
                                              Entropy (8bit):3.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5206EB9697BF5F2978F399F4869CBF18
                                              SHA1:4D6AE0E8CCEF787681E0F6C9E912EA41CDFFB758
                                              SHA-256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
                                              SHA-512:634535B9A6AF54D3B78A85F8F473E09BEA0D2C47C8E97B84B5F879DC1E7E9F387C81A80D1221A04C26AD7AFBF14D8DBCFE22430BF3EFBCEAE18EDA45E964DBB3
                                              Malicious:false
                                              Preview:krome ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-JTT37.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):642377
                                              Entropy (8bit):5.1998846752068415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25F04D46B9A498FE87545046C6087056
                                              SHA1:1979BB74E2B33AF5B2B57E71E7676F009A04F4B6
                                              SHA-256:0CFE6903A57AEE9AF4BF5B7865CE75CD9A5D9BE5FECDA1965582A4E9E76A45F1
                                              SHA-512:1191F229107B060AB9BE96624CCBAADAEF892539000E27AF352A22215F590875028E27C34853905730E7A33845E0152F28E7B8B8EE45A42481EEDD58F601ADE1
                                              Malicious:false
                                              Preview:...........r....12.0.267.14.........................................................i(..i[.......z..............a........a........a........ar.......a2.......a...........rt....t...2u....u....u...Rv....v....w...rw....w...2x....x....x..(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-LI5F9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1649752
                                              Entropy (8bit):6.513026085681496
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:971F982664399F305E11A44A7F2E7CEA
                                              SHA1:0480BF32029151C8759F9183E61507F205FA7D9B
                                              SHA-256:88BB3A6653278E6613782CE6444A7D0A20B0EDE964D0BCA554BB186654AE1873
                                              SHA-512:67FBD59F37789D407520E78DF9FB911E98314678EC3AAF7EA46E5B6312468A61E54A8508F7DBDF8401C4083847C0CE0D15DABD0E6DE2DA35936B79C3C05A8BE3
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 4%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........L.................@.............................@......=.....`.........................................`W..Z....W..........8...............X(... .......F.......................D..(...P...@............`...............................text............................... ..`.rdata...D.......F..................@..@.data....... ......................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...8...........................@..@.reloc....... ......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-MBJUT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8178684
                                              Entropy (8bit):7.996793493800157
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:3E2E5EBB90FDD6540201009176A9BBFD
                                              SHA1:18AAF387D73A0CBE889C15FDCBD403DE18BE17CD
                                              SHA-256:B9C6C00F6D20A9F93EEF7341A1D036BAC8BB46501CC829AC12DD8787150DD488
                                              SHA-512:15FDF41B9D9A60D1D5377B57F4B0BBE782BD85828316E001C5CA06BADB0D23374E0FCD27294BF263DB31D8BED30A29C8250C03383C3385869279B56EDAC1DC84
                                              Malicious:false
                                              Preview:............f..:..{.PE..|.$H..~..K....3^.....`....R.....d.............................0.....W...........O5.....8....=:....f;....GD....]E.....G....+H.....I....AJ....vM.....s....mt.....{..........e......................2.........2;...7;....8;....E;....F;^...G;....H;....I;J(..J;.7..K;pG..L;.V..M;.e..N;.y..O;....P;....Q;....R;....S;A...T;#...U;....V;L#..W;.9..X;.S..Y;.i..Z;....[;....\;M...];....^;...._;.....<.....<.....<.....<4....<c....<.....<.....<.....<.....<.$...<$+...<,/..(=./..)=.3..*=.5..1= :..2=.C..3=}R..:=9s..>=.t..?=.y..^= ..._=U...`=....a=....b="...c=....d=.....=.....=Q....=E....=.....=.....=#....=.....=1....=.....=.....=.....=.....=.....=.....=.....=.....=.....=j....=.....=M....=.....=.....=g....=.....=.....=.....=.....=.....=+....=<....=r ..&>HH..'>.I..(>.J..)>wO..*>.V..+>7X..,>.Y..->j[..:>.a..;>.d..<>.g...@lm...@.o...@.q...@.r...@.u...@.x...@ty...@(|...@'}..BEP...CEl...DEl...EE....FE...GE0...HE....IE....VEF...{E....|E....}E...~E.....E.....ES....EK....EI....EH....EV....E..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-MH764.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1048078
                                              Entropy (8bit):7.950396437745758
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:102C7F476668759F051DCC36C61A934E
                                              SHA1:25FA1A726D596E9A25CE500A49D1E9CDC7134791
                                              SHA-256:E0EAAF4E8F1AD3E024387FDAF46FE67DA28B751FE18F473E5B6D968E067D5B07
                                              SHA-512:BD68480E4F46574309406DDC5F6862B92070026CC5E468C38906F8AD6A265016B3C0E3B3C9981473807131469B3E5621E3A2A7BEAA64D71974FB2A99EE5C1D6F
                                              Malicious:false
                                              Preview:..........L.........+...........|.....#..........;.....;x....;....;d....;....;P....;.....;'....;.....;.....;_....;.....;-....;.....;.....;W....;.....;.....;.....;3....;Z....;.....;.....;-....;.....;}....;.4...;.R...;3g...;A|...;.~...;.~...;.....;|....;.....;.....;.....; ....;....;#....;.....;t....;M....;....;.....;C....;.....;.....;....;R....;.....;.....;k....;.4...;.6...;e8...;.:...;7B...;.R...;uc...;.t...;.....;k....;.....;.....;3....;.....;!....;W....;@....;.....;./...;.B...;BR...;.e...;zy...;&....;.....;?....;.....;E....;.....;.$...;.8...;.P...;._...;Mx...;I{...;=....;.....;=....;.....;.....;.....;.0...;fB...;}^...;?q...;=....;.....;.....;9....;s....;Z....;.....;.....<=-...<.;...<.Q...<O\...<Pf...<.m...<.v...<M~...<.....<6....<.....<L....<....</....<.....<.....<.+...<.X...<.y...<.....<.....<.....<.....<.&...<|D...<.b...<.}...<`....<.... <...!<n..."<5B..#<.B..)<+D..*<.f..+<...,<9...;<....<<....=</...><...?<)...@<....A<....B<g...C<8...D<u...E<.B..F<.F..G<.L..J<.T..K<.a..L<.n

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-OVDJG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):455680
                                              Entropy (8bit):6.344963333214366
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3137029764C050067D41B71BC210F932
                                              SHA1:73B6C4847F5DE202D71E45F231C3B42B9F9AB470
                                              SHA-256:DAE17055C7F0065FC9D421CAC0C7DE0E6BEA0FC7CA3AAAF3DB5C44AC9E754D8E
                                              SHA-512:BAE88C49F31E64F7A45BA689D820E8ECF83697C9BDE69E430D370C3B12BA17A23ABC67036B8CD20694CCB46A86DE1E691E0CCD5E58A6DA031F98BBAE969CA93D
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .................&....................................................`A........................................`...h.......(.......x.......4A..............P.......8.......................(.......@............................................text............................... ..`.rdata..dw.......x..................@..@.data....K...p... ...N..............@....pdata..4A.......B...n..............@..@.00cfg..8...........................@..@.gxfg... &... ...(..................@..@.retplne.....P...........................tls....!....`......................@..._RDATA.......p......................@..@.rsrc...x...........................@..@.reloc..P...........................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-Q3F4Q.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):228
                                              Entropy (8bit):4.890604933532555
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D82A50C6750AF1EA0480E648E9B7EC97
                                              SHA1:64B84CDBABA77625C95C29249F872BF72BCE8081
                                              SHA-256:343EEDBE46C18B0ECCD53B5760368A599BE3BAC084FCE25CD693947B3BD08901
                                              SHA-512:6520CCE1B30D1C8FF151AF20BB3AA3CDB104D0F3CA16D9736FE6642051694D88258CC3F9607710AC386B93EFF4FDA8533E0C41A335932613C98D78B14E9667A7
                                              Malicious:false
                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='120.0.6099.199'.. version='120.0.6099.199'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-QA32S.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):686222
                                              Entropy (8bit):7.962928283524176
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48321D24D66927A1D1ECC339E1845259
                                              SHA1:3668BEA05AC282130D7B1BF5CCF4A2CE303581D0
                                              SHA-256:D02726B9814E34DD40C470DB848CDD8B2BE69A2E25766CF9EB2F82AE25B08004
                                              SHA-512:9C9D45F7C2F309519582A9F0D6A116021C37D28A2EBDB31F1F6DC5FECF836D2E714D52D015AA9FEAAE692798AB42B6C1C60D715C9DB442733E10D0A675D9E8CE
                                              Malicious:false
                                              Preview:..........L............... ...........@..........;M....;.....;$....;.....;.....;b....;.....;!....;x....;....;5....;.....;....;@....;.....;....;L....;.....;.....;.....;.....;&....;l....;.....;N....;.....;.....;.....;.....;.....;.....;.....;.....;.....;H....;.....;.....;g....;.....;.....;.....;s....;@....;.....;f%...;.%...;`&...;.'...;.'...;A(...;.1...;.:...;.N...;.b...;.c...;.e...;yg...;.j...;.q...;.x...;.....;H....;.....;.....;/....;~....;*....;.....;.....;,....;.....;.....;.....;.....;:....;8....;.....;.....;.....;D....;.....;.....;."...;a+...;.3...;79...;.A...;.B...;.`...;3z...;.....;d....;=....;.....;Y....;.....;.%...;W8...;Ia...;.u...;t....;!....;O....;*....;.....;.....<.....<E....<.....<."...<.,...<.4...<y<...<.D...<.I...<vU...<._...<.c...<_h...<}m...<.~...<.....<.....<o....<r....<&....<R....<.....<S....<.....<.(...<v7...<;E...<'O...<!V.. <(]..!<3r.."<...#<:...)<....*<"...+<#...,<...;<7...<<*...=<...><...?<....@<....A<....B<&...C<....D<....E<....F<....G<....J<....K<Y...L<5$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-RVMTK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1253888
                                              Entropy (8bit):6.461722096170348
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:417E6D505060EA7B80F3EEA2FB37FC73
                                              SHA1:8FF255320737334ABF8EE4BBCFFA005E4CF5C594
                                              SHA-256:52539B62716646F3E0331FCD26B70F66AFC65D1CB7A60A0CA42947660DF626FA
                                              SHA-512:E5455F8DFF85661965B52F197644911EC5946925C68B982DC24A9CE15F0FCC405E316F66255283906DC5DB22B2B4761FD0ECAABC14BA8203AB8C7E0EFD074349
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....|...................................................`............`A................................................=...P....0..p.......\............@..(...L...8................... ...(.......@...........X...............................text....z.......|.................. ..`.rdata..............................@..@.data.......P.......8..............@....pdata..\............8..............@..@.00cfg..0...........................@..@.crthunk............................@..@.gxfg....-..........................@..@.retplne.................................tls....z...........................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...p....0......................@..@.reloc..(....@......................@..B................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\is-U1PHM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1257472
                                              Entropy (8bit):6.459845894027243
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4C20C7112B6E8BF10D7DF44D97840C5
                                              SHA1:17FFBE2E4CA78C8ECE222D0CD84D795F1CD5E1BB
                                              SHA-256:64C045C166D59F16DA04DB35B6FA4E4418C4B1A36379020D38D72F7CB7F86E31
                                              SHA-512:8DDFEBE870EA20754D36FFF6496BE798FDF5A11237416429494AE0A55D5F6ED527895D111C3F066FA2809D94E4E615F9EE878221567C1327E243C948A831DCDA
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..................<.........@.............................`............`.........................................p...\...........0..(.... ...............@......L.......................0...(.......@..............0............................text...v........................... ..`.rdata..............................@..@.data........`.......H..............@....pdata....... .......F..............@..@.00cfg..0...........................@..@.gxfg...@-..........................@..@.retplne.................................tls................................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...(....0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libEGL.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):455680
                                              Entropy (8bit):6.344963333214366
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3137029764C050067D41B71BC210F932
                                              SHA1:73B6C4847F5DE202D71E45F231C3B42B9F9AB470
                                              SHA-256:DAE17055C7F0065FC9D421CAC0C7DE0E6BEA0FC7CA3AAAF3DB5C44AC9E754D8E
                                              SHA-512:BAE88C49F31E64F7A45BA689D820E8ECF83697C9BDE69E430D370C3B12BA17A23ABC67036B8CD20694CCB46A86DE1E691E0CCD5E58A6DA031F98BBAE969CA93D
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .................&....................................................`A........................................`...h.......(.......x.......4A..............P.......8.......................(.......@............................................text............................... ..`.rdata..dw.......x..................@..@.data....K...p... ...N..............@....pdata..4A.......B...n..............@..@.00cfg..8...........................@..@.gxfg... &... ...(..................@..@.retplne.....P...........................tls....!....`......................@..._RDATA.......p......................@..@.rsrc...x...........................@..@.reloc..P...........................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\libGLESv2.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):7727616
                                              Entropy (8bit):6.443214904498888
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9C358F1191CF2D4E77A90FB2AB57D9BE
                                              SHA1:D94FC8A441AB565407CAEAAF2F05C381A550FAF6
                                              SHA-256:BEBE06A370169EC96EE868C9DF34CBDA2C97632F4F8935097B8D777089CE3425
                                              SHA-512:8B6FD15DCE4A6117D9C4D11A93995C8CF0DB34A320E7277CB37C9252897F55459438C0FCF7D5767A0D62CA8C7331276846BA5763FDBC7BEA63946F0447DC9B7C
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." ......Y..,.......aV.......................................v...........`A.........................................[m.....S8n.d.....v......0s..T............v.......l.8.....................l.(.....Y.@...........H=n......Zm.@....................text...%.Y.......Y................. ..`.rdata...:....Y..<....Y.............@..@.data.........o.......n.............@....pdata...T...0s..V....r.............@..@.00cfg..8.....u.......t.............@..@.gxfg....,....u.......t.............@..@.retplne......u.......u..................tls....B.....u.......u.............@..._RDATA........u.......u.............@..@.rsrc.........v.......u.............@..@.reloc........v.......u.............@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\af.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):425311
                                              Entropy (8bit):5.395319539126201
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:44396D9D8F0F0AE4CE756C49D534FD3D
                                              SHA1:8FAB9BFFFCF3B5B7C68C746F32F6A44CC4E1CCFF
                                              SHA-256:AF7200191D8EC87E6A9CE38F40E9B125E6A7896B1531E86773E24F79D82FB47A
                                              SHA-512:67EC69EC2595B6E35D428E0D4E395D1245A2FE9A16556171854F9C6FFB1E8102F8BD90F10996E2F162D7DF00CA94E7E194C56631994F3BDB6B1D92E4F452B23C
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j.....w.......................-.......................a.......................s.................1.................,.....E.............................v.......................j.......................y................. ....................... .........................................(.....>...........&.....o.......................8.....I.............................V.............................q.......................e.......................A.....i.....r.................1.....:.........................................4.....K.......................&.............................d.......................\.................$.............................R.......................R.......................x...........D.....X...........1.....p.................V.......................-.....Q....._.................8.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\am.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673037
                                              Entropy (8bit):5.040592901795516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D5E58828AFDA6783690ADAE466AC3346
                                              SHA1:B716C2D7012C3CBAFD39E62EEF0B4A7BE3691A87
                                              SHA-256:55DA7EC2D2E3018270D67B759EDEDFE11F64BF41CC7C6443E3B07540C78E5689
                                              SHA-512:B5A5522FBC5FB1F31DF7AD7D939A57CD004F5ECC7A65E5E9F567C6543D7591763BC6D541C56FA3663BC19C6314382645AEBB274FBCC7EF4E539A946C3457A126
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...........................................................J.....j.....+...........Z...........].............................9.................J.................%.................h.....~...............................................G...........`.................~...........l...........7...........(.....G....."...........i.................m.................0.......................\.............................l.......................%.................(.............................5.................".............................^.............................+.....R...........J.................?.............................K.................z.................8...........\.................|...........^...........Q............................./.......................H.................6.............................&.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ar.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):739356
                                              Entropy (8bit):5.019903284276821
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25DE0C26D95E19F5DA6B5D71A10EB0FE
                                              SHA1:1C3854692C3D03FEDB106AD330DB9A6EEFC454A7
                                              SHA-256:20F07E78D04C499DBBDD49C6495832FC98B401450EA349F236CB2E2460DF2996
                                              SHA-512:A66A2C29E65394E0DFCDDC393FDED51F18901D2E42879CCA8F3A0020A1F0B4B5F555EDA4CE3AE1318A20CE4190CC3064FF06A2BE6E3CB1C2BFEFB7A6E35ECA3A
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w.....y.....z.....|.....}....................................................... .....%.....>.....[.............................K.....o.......................!...........}.......................r.............................a.....x...........k.................T...........8.....}.....8...........J.....p.....O.......................c...........W...........&...........a.....|...........p...........O...........].................N...................................W.....w.....'...........Q.....o...........n.................d...........N.....r...........w.................S.................4...........k.................m.................E...........@.....u.......................4...........W.................\...................................d...........................................................c...........A.....x.............................C.............................G.................[.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\bg.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765476
                                              Entropy (8bit):4.7975051327532885
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D67EFF3B26F9936A13D7D5D0570F80B
                                              SHA1:FF49B010D1723EC7AB625C8C586906F27AC09C82
                                              SHA-256:854BE8369C455D8321A8784FC4957CF402D75178F9CE74F7C131CD68E85CF6F2
                                              SHA-512:71C6F7578457DAB046142E39B7EDB19A362B712E81DEF3A0E4BF94E44015930A3CA24EA83A76E03A4EC65DB73EEA389E1AB8C2D78F93CB239F701845AFCE65E0
                                              Malicious:false
                                              Preview:........? x.e.l...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....|.........................................y.................1...............................................u...........<...........g.................l...........D.....j.....V...........v.............................T.....>.............................2.......................s.........../.....B.............................+.....j...........8.................C...........h.......................%.................N...........".....A...........T.................M................./...........b.............................c...........?.................=...........E.......................].........................................2.................'.........................................!.....V.....F.....!...................................g.....2...........%.....].........................................N.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\bn.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):970497
                                              Entropy (8bit):4.416502608555437
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11AF78A74835CB6CD030453E00D48320
                                              SHA1:5801BCE64FAD3B107BFFBB010D911B585214D281
                                              SHA-256:79588276DA84298C19C112AE665D01362524A775436FF85AFD9F3BA65CBCCA85
                                              SHA-512:38BAEAC624A95659AA06CC2A2C60521D874CDD6CDB9B1290C458A771B1F25D085711387303E13B5078588C46653FB3E9DDF73512FDD7DA88359AFD50A0A85F68
                                              Malicious:false
                                              Preview:........+ ..e.D...h.P...i.a...j.m...k.|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....?.....G.....N.....U.....\.....].....^.....c.............................?.....I...........A.....6...........................................................D...........@...........m...........Z..........._.............................s.....Y.....0.............................Y...........U...........g.............................K.....o.....g...........a.....*.................;...........s.................r...........7.....Z.....:...........S...........O...........K.....w...../...........#.....I...................................R.....................................................`...........=.................8.................3....._.....G..... .........../...........z...................................!.....$...........z.................9.....,....._.................= ..... .....!....A".....".....".....#....{$.....$...."%....(&.....&

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ca.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):483305
                                              Entropy (8bit):5.374751120312463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6859AD6CCE882ABB0A44C0346F472D60
                                              SHA1:3500DC166D1E0BB0CA7B8A63DB3C5AEFB9C952B8
                                              SHA-256:2EE150C1BBB0C8271470312B4A0B217E2BBB33AA62D19C76EA13CBEF7EF06FB4
                                              SHA-512:E482DCC2D8A3C28EDD6AD688A16E107B107155FB83A388227DCE56CED735288E1384BF49AFEBB31850B67B516CEF8B328EB0A305ABA07F2494FE4F0031C58981
                                              Malicious:false
                                              Preview:........4 ..e.V...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....c.....}.......................y...........u.................i.................^...........B.....a...........$.....\.....y...........(.....[.....n.................R.....c...........M.................B...................................2.....F.................7.....K...........).....n...........%................./.......................,.....|.......................Z.......................Z.......................i.......................V......................./.....z.......................j.................2.......................g.......................b.................*.....y.................H...............................................k.......................u.................&...........K.................X...................................0.....P.......................$.................<.....X.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\cs.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):484288
                                              Entropy (8bit):5.8243114746271765
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:485EA7CEEE6AE86812D834B6AF09B9CE
                                              SHA1:72F04594DF8C55EF4D3A9480FDC91320A7795C05
                                              SHA-256:66BFD87719482196D0A92D46DE25EE6E76B33CEFC8722748377444D7C0C637E6
                                              SHA-512:1734378C3680A5A544A24671D439C7D6F11F54A2382A8F77D7A937FAACE1018D8900128815438BE1973C26209A8CBD02908712535275A7CD7ECB2675DB2EA769
                                              Malicious:false
                                              Preview:......... ..e.*...h.6...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................%.....,.....3.....4.....5.....7.....G.....Y.....k.............................-.................&.....5...........8.........................................C.......................?.......................B...................................Y.....{...........b.........................................?...................................M.....g.................6.....M.......................0.............................n.................".......................,.....}.......................r.................#.................,.....@...........5.....y.................(.....C.....W.......................8.................+.....A...........!.....b.................?.....Z.....n...........Q.......................p.................<...................................f.................j......................._.......................r.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\da.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):447763
                                              Entropy (8bit):5.433512556683707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4B255615C23E814B83D07D2589B6873
                                              SHA1:E5F1BDE47A801CA0AC3301A91FF1777AE4CD521C
                                              SHA-256:C37B702D42F00B85986B914763323B13E125135A1DD6D70EB061AB818C6963A7
                                              SHA-512:BC35E233DA11563D508E5F4819AA1CD10BCB9F64897F569E4BF2256237A271795FEDC9CEA5B528D26466AE95E8E0127DC69EC90280D776E28C2E55DE31E277AC
                                              Malicious:false
                                              Preview:........= z.e.h...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|.....~.............................:.......................o.................6...........B.......................{.......................n.......................V.......................W.........................................U.......................|...........!.....5...........>.................;.................9.......................(.....v.......................O.......................:.......................@.......................9.............................x.......................a.........................................R.......................6.............................g.......................|.................L.......................L.......................d.......................`.................&...........7.....m.................h.......................B.....^.....k...........-.....d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\de.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481827
                                              Entropy (8bit):5.468895402229888
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BE0AA0C39FADFD77D58CE689CBB42ECC
                                              SHA1:66F8B730DB8405EFC1766AB3742D6F3096221E3B
                                              SHA-256:22D1AFA7755CA9AC4AEA0015C51639F3DF160E88C072BA534E9481E1ECF641EF
                                              SHA-512:0F63D76118367E16BEE3A02E42577C903661DADCD5A0FCBD90C05CEE5119026492AF6559250BAEC9EC1370B81D7611263BE90C1350E2235D3360D315BA1645C9
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.......................o.............................).....b.................c.......................}.................H...................................b.....l.............................e.........................................)...........(.....`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\el.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):834421
                                              Entropy (8bit):4.876465138992703
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EB779878D14C459E60B04FE3154AAE6C
                                              SHA1:781A2502679E3464B2DE04319A17EB123B38F589
                                              SHA-256:0784AE7F982172A3F0C9FD654A3781D263F98A01AC702291D404F70DD7AF371E
                                              SHA-512:527CDDA3CF3EF63EF6331AAD0A68572F1276A9CB6A93E8931A96FF90974E818549E96DD6A8963222C5DD67BE7D2910B46619E609A8DFD9EC8BB955AA88051F7F
                                              Malicious:false
                                              Preview:........8 ..e.^...h.j...i.r...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.......................(.....O.....-.............................p.............................`...................................%.....{...........A........... .....@.......................g.....o.....i...........8.................I.....d.....K...........y.................P.................:.....2...............................................V.................d...........R...........i.....C.......................o...........................................................$.............................%.....-...................................,...........U.................g...........U...........o...../.......................R.......................B.......................m...........&.....P.....k.....!.....Z.....[.....B.........................................u ....?!.....!.....!.....".....#....P$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\en-GB.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):390679
                                              Entropy (8bit):5.489673740325356
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E043647BD2DAE08B42867F76C9F8A7C0
                                              SHA1:00F62CAA07C28A99D3DDF64F1E0D346C1DD0B9EB
                                              SHA-256:A60148B1795518660991015F7083E0CAAC406E9188EEEF7A9675B57CD1424DF6
                                              SHA-512:88AF4FD99880C0AFFE4E3D87C6E34100E0B235E92B2B5C302A6D470521E38C1A783F6FF20D2B4F2DD0FBB708EE4AC0446EAC659BED0D24B77654928E6C330237
                                              Malicious:false
                                              Preview:........s D.e.....h.....i.....j.....k.....l.....n.....o.!...p.....q.4...r.@...s.Q...t.Z...v.o...w.|...y.....z.....|.....}...........................................................................................'.................A.....T.................).....9.................5.....K.......................4.............................F.............................T.....y.................G.....|.................5.....f.....t.................6.....F.............................|.................0.....o.............................I.....h.....r.............................x.......................Y.......................$.....i.......................).....Q.....\.............................~.................).....w.......................9.....u.......................9.....Z.....i.................B.....h.............................l.......................[.......................V.......................}.................(.............................L.............................h.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\en-US.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):393882
                                              Entropy (8bit):5.483434307919725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B7B76968BD06518708C4EE49057C3C21
                                              SHA1:C709EA98C29253F44C4535D69CEED0C7A5A10D89
                                              SHA-256:AE3EA3E3C6AEBC3B2A117E3260DB57920A300F53234347C5C994A6667697A7B9
                                              SHA-512:538063408F1F8FE5294763AEB28EDBE3F7AEB09D14BAB32C67CD117B56DF9FCF13F8A31D4C74E8757B5CDA550AF4BA99C9BF6E26E75A6B1FDFAE036628BA1E29
                                              Malicious:false
                                              Preview:......... ..e.6...h.B...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....b.....r.................W.......................U.......................U.......................K.....z................. .....I.....W.............................h.......................G.......................9.............................\.......................+.....W.....b...........+.....m.............................!....._.............................B.....c.....o.................I.....\................. .....,.....u.......................6.....z.......................;.....d.....o...........*.....h.....}.................-.....C.............................M.............................d.......................;.....V.....e.......................>.......................3.................M.....[.................N.....k.................9.....H.............................Z.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\es-419.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471567
                                              Entropy (8bit):5.354079420195156
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2BAF163FA95FA30FC29E2E5871D24CBD
                                              SHA1:9381B41FFE7EAEB7B269FEA54160BC6AB7871548
                                              SHA-256:EAA363739EC52548F4A32F9C6ECE214FE5534AF8A0597D271F6AF26AB2263B44
                                              SHA-512:B053B7503C1E650B2094DB6003B93ECC9A34E0847312B418AE813036644E4DBCBADEA914F546EB4753C3B30642A9664B737D4F9C3F4DE6602112A1F67511725F
                                              Malicious:false
                                              Preview:........> y.e.j...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................X...........L.....g...........?.................0.................+.................Z.....u.................B.....U.................:.....K...........E.................D.................".................D.....W...........,.....j.................m.................h...........@.....g.................-.....H.................!.....0.................(.....>.................`.....s...........7.....u.................-.....^.....i.................B.....L.................Z.....j...........]................./.......................9................. .....w.................H.................@......................./.................%.....>.................W.....q.........................................P.....~...........d.......................U.....x.................|.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\es.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):470778
                                              Entropy (8bit):5.34217037343731
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E004770D6760C02517131A19939E118
                                              SHA1:A326BB7848CAA86E7E07A5D4986C31348EC8CC50
                                              SHA-256:A687A109FF23A4A7CDD422BE9419987D942725E289856A65129C0499199E4DFE
                                              SHA-512:4DCFBAF81006095B2C4E0EC98F94294A01EB45A1D42A933067AF9110FDD6F14EFECB1F8900FE541F772D66C60484C9AE6B644C7852364486B0072D7F132423EA
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................c...........[.....v...........X.................D...........4.....N...........1.....m.................C.....r.................D.....l.....}...........w.................k...........$.....B.................].....n...........>.....z...................................{...........?.....d.................L.....b.................6.....E.................>.....T........... .....S.....f.................O.....[.................9.....D.......................&.......................#.................X.....r...........(.....T.....q...........".....I.....h...........O.....t.................|.................a.......................U.......................k.................&...........:.................=.................1.................U.....i.................4.....G.................X.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\et.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):430694
                                              Entropy (8bit):5.456758351557824
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22F9E4FE76C5CF3239DE215AD36D3FCC
                                              SHA1:E71E47F00187A851B1DB6ECC5A2AE2C3F942E039
                                              SHA-256:F8E9C973248868531DF9EB55A914C30E1FB3CA9BC4B6CB7DEAB65BB8919FF158
                                              SHA-512:E8AD9C50CE97F5F0563DDA08B870FAABE660FF4A495EB05173E9A6E6E297668F9BBCB08C73D2731604A221111BFCA4AC0982B3ACD68EAF452B9F19EE68180FAE
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................Q...........H.....c...........2.....b.....u...........W.......................s.......................k.......................Z.......................Y.......................~.................5.......................9.......................I.......................v...........9.....P.................7.....R.......................*.....}.......................u...........!.....,.................-.....;.................%.....-................. ...../.................".....*.................M.....e.................2.....H.................*.....M.................2.....?.................;.....g.................$.....5.................!.....9.................=.....X...........S.................A.................,.................>.....K.............................}.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\fa.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):678188
                                              Entropy (8bit):5.164547717738943
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0B950CEF45650A2BD1591C494ADE1D6F
                                              SHA1:DC2AAB36C670E1962BA10517769EDE124BAE27F6
                                              SHA-256:21CF1181DC3002C1BCB1B58127FB2F778F01E6277C73611868AC0B55B95A2633
                                              SHA-512:5DF42AE149E302E83E297D872E6F3B71E064E582ADD7A231D3889936485EE0339AF259F2EB51A1DAC464082832039B55B36CEBC55093A5CB42F68163F850A02C
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.$...p.1...q.7...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}.........................................................................#.....M.....t.....Y.....*.................~...../.......................?.......................h.......................-.....s.............................&..........._.......................1.....}...........;...........'.....C...................................e...................................0...........9.....m...................................o...........E.....\...................................".....i...................................d...........4.....V...........|.................|.....+...............................................J................._...........L.....l..... .................W...........M.....r...........G...........C.....e...........................................................0.................s...........i...............................................l.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\fi.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):435709
                                              Entropy (8bit):5.427114715109804
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E226109EBF9A43AF5D95F6066B24915
                                              SHA1:076AB0214579858F697D7193847AFC3A046390D8
                                              SHA-256:39D5B787C10047C718228DCFCEDA3576FE9201DB0BB99CC60BA5D6BB5AE48560
                                              SHA-512:132726A998DBF27C410D318CBA7DA9D5F140D612FAF68F1FF5F5A40155C829E387C1CDCDCEEC77441CEE7B79F8634FB090ACFE4F17550806011B2574249AD712
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....|.....}.........................................................................#.....4.....G.....`...........e.................6.......................H.......................o.................".....y.......................W.......................-.....|.................4.......................Y.......................U.......................X.......................x...........0.....F.............................{.......................A.............................[.......................?.....n.....{.................C.....N.................-.....=.........................................8.....P.............................k.......................a......................._.................!.....i.......................3.......................4.....~.................W...........$.....9.................6.....R.................<.....N.............................W.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\fil.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):489863
                                              Entropy (8bit):5.201818119132309
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3C9C48A7DD48CC2B23055475FE9E228
                                              SHA1:91144E5B4C21C9520B1D61F8E41CE91747D518DA
                                              SHA-256:6EC573C3A957A655B024E23CC8610C4DCE840181F23546FEBE7E8CBA89C4583A
                                              SHA-512:6956C9FA70B4210A3635E6D2FDBB53E2BEBC3A56B40CB783C2D7F820E180E5F4487A766EA8CF0C88EBAC023D3368DB873479D1A4B845DFFADC7653B68CE8FBAB
                                              Malicious:false
                                              Preview:......... ..e.(...h.4...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....h.....~...........7...........&.....D...........;.................=...........*.....Q...........F.......................j.......................}.................T.................4...........J.................9...................................4.....N...........I.................B.................P.................:.....W.................-.....:.......................'.................?.....U...........!.....W.....f...........).....[.....i...........*.....[.....i...........,.....^.....l...........m.................>.......................8.......................(.......................Q.................A.................2.....L...........*.....].....x...........l.................u...........x........... ................. .................6.....N.......................D...........:.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\fr.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507710
                                              Entropy (8bit):5.366267790955764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E7EECD5B19E0FBE4A6D6FAFA81209C4C
                                              SHA1:46BC876FB95610EABD7F8A4734B45FBA629B76E2
                                              SHA-256:9EEEE70495C1D52F4260E86B23ACF8AEA21E68008A45A41BA0556AD48EADE2BE
                                              SHA-512:09E2AC627360DE3A8D5172E8E8BE084AEE07127CBA04D042213A9E9EEEA35011952DF49EAAB0F28DAE587ECA61D8CAC5EB7B197BDF96044265F52AB507D9D471
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....f.....t.................:...........Z.....|...........c.................K...........0.....L...........'.....{.................X.......................h.................C...................................L.....p...........N.......................w.................<.............................1.......................r.......................l.......................r.................".......................;.......................>.......................+.......................$.......................O...........3.....J.................>.....\.......................2.................8.....T..........._.................;.......................;...................................:.....Z...........X.................F.............................).....v.................>.....k.................k.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\gu.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):956384
                                              Entropy (8bit):4.455345909186297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D78D3F526EDCEF1C7923475F99DDE3B2
                                              SHA1:613FC2E4B43DDCCB4EDD2F16903C3860B8563188
                                              SHA-256:86B9C50EF9CD617F969AB66F1DBB4F95A6A2E7EFB588707403F35B4E84330B6D
                                              SHA-512:0EDF39DD4F11F29E6927F88FA13CD0059E1C59653E0833F1FD21266D2E764D6FC127D9C3541A854D373E25F6949094B91ED83A18F9EDAB7BA88E93E6D0198129
                                              Malicious:false
                                              Preview:......... ..e.J...h.V...i.p...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....l.............................R.....O..... .....\.....O.....................................................Q.......................7.................b...........L.....l.....O...........j.......................F...........^.....2...................................'.....$.....................................................$.....`...........@...........5.....]...................................................................................m.......................3.................Z...........e.......................L...........;...........B.....k...........p.................q.....R.............................d.................).....l.................G.............................#.....V.....}...........x.......................,...........l.....8.................. ....c!.....!.....!.....#.....#.....$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\he.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):602433
                                              Entropy (8bit):4.7884870034691005
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:16970B0DFB5555779A8CE95D96BF97F2
                                              SHA1:432C8BCA1953C5719E4CA4310FA5558436103D6D
                                              SHA-256:C7B170DCF4DD84C2EA8A454C5D82D7F0C9AD9A98127E66263FC3CE0D91952254
                                              SHA-512:D20AFC7C4C648266C96CD38B8A27479884AD1C31C8C9C7B6FF7AEF14331B72EDC2E505BF83A25A767B5889FDF504649140EFF69EF7478A5DF7F04B1F507617AA
                                              Malicious:false
                                              Preview:........! ..e.0...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....].....v.................q.....'.................[.................2.........................................U.....w...........l.................9...................................1.....a...........x.............................g.................}.................e...........,.....E.......................9.................J.....w...........a.................=.................,.................^.....q...........g.................6.......................g.................'.................P.....c.............................{.................3.................2.....V...........M.................[.................S.................<.....U...........8.....i...........(.........................................8...........`.............................V.....}...........i.................r..........._.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\hi.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1008891
                                              Entropy (8bit):4.429572949324661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1E0B6E2E70F684C3D31795392F445E0E
                                              SHA1:D09B97D9D82119CBDCB2DC54816A0036B0188871
                                              SHA-256:D3F548279F8FA875B7F9918C19BD0D2760CBC126682E1270E3CB90D780A6EE50
                                              SHA-512:FBB275084BB3D6F62A5D0965AA56982E55D2B9471AD54670433421E2F5DFCE3B32EC4DEC75F235B907A436A0329CD0739F492ABEB5B38E349EB03F6F6A31A012
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................*.....O.....z...............................................?.....z.........................................^...........`...........n...........V...........Q.....t.....[...........^.............................\.....6...........f...........v...../.............................\.........................................Q.......................:.................K...........%.....>.................:.....k.....*...........<.....[.......................'...........z.......................Z.............................d...........P...........H.....t...................................F...................................s.....'.................5.....).............................y...........R.........................................c.................. ....V!.....!....."....^#.....#.....$.....%.....%....\&

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\hr.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471753
                                              Entropy (8bit):5.511235500490613
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA4907C0D4CDFF16C22294C962A8400
                                              SHA1:4D60838FE85A2E02269D107DFAC82E9206202640
                                              SHA-256:FACD97D583B2047C4AF1C230F77ECB031495376840229E0CDB2AD463F3EC7FBA
                                              SHA-512:23FB9358B57FB313CD76CAC03E19E2A40074ACF37CE23F8138C1A13FD571EDC8C80AFBE9172CBDC2DE367004E05A7E34B26F00B13BA17DB003B3A9321C7B207B
                                              Malicious:false
                                              Preview:........S d.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...|.Z...}.l.....t.....y...............................................................................................o.................\.................-.......................{.................2.......................................................................6...........3.......................u.................5.......................W.................1...........J................./.............................Z.....|.......................@.....P.................J....._.................<.....K.................N.....c.................6.....F.........................................i.................$.....F.....c.................).....I.......................6.................[.................7.....\.....r...........?.....q.................k.................c...........>.....P...........8.....v.................].......................:.....X.....j...........F.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\hu.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):508122
                                              Entropy (8bit):5.631450824927112
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BD724FD924C465E0335F444B09413970
                                              SHA1:E5A630E412985FC9393456F48869EC6B4286AC3C
                                              SHA-256:18DA515A2174A5FE97F0DDF58AAC49911BECDFF848D0AEA9C7A3B22E526C548D
                                              SHA-512:F2A8937DCD17FEE6ED92380735A94123CD19C8EA967C1E8BB6747A482B68FBE47A08AE8482C92E2DAA688509BAE78F0D5E51FD5FDF4940770FBE6354AFFD0251
                                              Malicious:false
                                              Preview:........$ ..e.6...h.B...i.S...j.]...k.l...l.w...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...................!.....).....1.....8.....?.....F.....G.....H.....M.....].....s.................J...........k...................................\...........B.....\...........T.......................}.........................................q...........#.....T...........{.................i.................0.................Y.....i...........l.................a...........M.....l...........`.................................................................g...........C.....Z...........d.................4.................!.................M.....b...........h.................9.................4.................?.....[...........&.....R.....{...........B.................*...............................................w...................................Y.....z.......................*...........Q.................i...........0.....L.................K.....g...........X.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\id.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):422094
                                              Entropy (8bit):5.375243450232671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4408935D4D1AE307034321C166C999A
                                              SHA1:14061D4DF638097B16D388A4CB48BAE69682E755
                                              SHA-256:5D94B52213ED07C3D45F221EDDFAA86312296BEBEB2B79FA3CE693F7B3A20B8E
                                              SHA-512:6A44CE38797C5317C13BDD4B999452A5ADF2324C01C59833051AA564166F64E0BCF70EFCE66CA4BAFC5388E1CF810DB28C9711667D021BCD6806572EA91F0809
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....d.....q.......................y.......................z.......................z.................;.......................>.............................`.......................W.......................b.......................N.....x.................-.....Z.....g...........-.....h.....{...........V.......................3.....N....._.......................#.....q.......................J.......................1.............................Z.......................3.....`.....l.................L.....Y.................C.....U.............................X.......................0.....v.......................Z.......................1.....K.....Y.................9.....H.................@.....Y...........Q.................'.......................:.............................Q.....p.................?.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-0CEEJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):483305
                                              Entropy (8bit):5.374751120312463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6859AD6CCE882ABB0A44C0346F472D60
                                              SHA1:3500DC166D1E0BB0CA7B8A63DB3C5AEFB9C952B8
                                              SHA-256:2EE150C1BBB0C8271470312B4A0B217E2BBB33AA62D19C76EA13CBEF7EF06FB4
                                              SHA-512:E482DCC2D8A3C28EDD6AD688A16E107B107155FB83A388227DCE56CED735288E1384BF49AFEBB31850B67B516CEF8B328EB0A305ABA07F2494FE4F0031C58981
                                              Malicious:false
                                              Preview:........4 ..e.V...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....c.....}.......................y...........u.................i.................^...........B.....a...........$.....\.....y...........(.....[.....n.................R.....c...........M.................B...................................2.....F.................7.....K...........).....n...........%................./.......................,.....|.......................Z.......................Z.......................i.......................V......................./.....z.......................j.................2.......................g.......................b.................*.....y.................H...............................................k.......................u.................&...........K.................X...................................0.....P.......................$.................<.....X.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-0HF7O.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1128054
                                              Entropy (8bit):4.173066636042835
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FB43B1980819D75556A4C8C32FB4BD95
                                              SHA1:B6F81B27E147EC1BCB2E0D3BC1344115C7BECDDC
                                              SHA-256:8E7F08307C90BF61616888A57C05D7E1E6B0182D01F7ECA895AD79B2C00F337C
                                              SHA-512:DFDBE66644B31D6801F0C3C11739FB498D71B3B7CE40919A1277155A45181C0E251E9E3FFB84FDE225F801A52ECD0F245DF050612862A2B24B5DEA939FB31EE4
                                              Malicious:false
                                              Preview:........ ..e.....h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....u.................D...........?.............................j...........2...........d................./.............................Y...........t.....V....................... .................w...............................................E.....m...........A...............................................".....%...........B...........w.....S...................................C.....n.....x...........V.....M.....>.............................=.....k.....d.....T.............................d.................D..... .....d....._.....G...................................P.....% .....!.....!....&"....O#....]$.....$....e%....=&.....'....S'.....'.....(.....)....e*.....*....5,....H-....).....z.....f0....P2.....3.....3....N5....[6.....7.....7.....8.... :.....:....1;....5<...."=.....=.....=.....?....C@.....@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-15IS8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):422094
                                              Entropy (8bit):5.375243450232671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4408935D4D1AE307034321C166C999A
                                              SHA1:14061D4DF638097B16D388A4CB48BAE69682E755
                                              SHA-256:5D94B52213ED07C3D45F221EDDFAA86312296BEBEB2B79FA3CE693F7B3A20B8E
                                              SHA-512:6A44CE38797C5317C13BDD4B999452A5ADF2324C01C59833051AA564166F64E0BCF70EFCE66CA4BAFC5388E1CF810DB28C9711667D021BCD6806572EA91F0809
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....d.....q.......................y.......................z.......................z.................;.......................>.............................`.......................W.......................b.......................N.....x.................-.....Z.....g...........-.....h.....{...........V.......................3.....N....._.......................#.....q.......................J.......................1.............................Z.......................3.....`.....l.................L.....Y.................C.....U.............................X.......................0.....v.......................Z.......................1.....K.....Y.................9.....H.................@.....Y...........Q.................'.......................:.............................Q.....p.................?.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-27FP4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481827
                                              Entropy (8bit):5.468895402229888
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BE0AA0C39FADFD77D58CE689CBB42ECC
                                              SHA1:66F8B730DB8405EFC1766AB3742D6F3096221E3B
                                              SHA-256:22D1AFA7755CA9AC4AEA0015C51639F3DF160E88C072BA534E9481E1ECF641EF
                                              SHA-512:0F63D76118367E16BEE3A02E42577C903661DADCD5A0FCBD90C05CEE5119026492AF6559250BAEC9EC1370B81D7611263BE90C1350E2235D3360D315BA1645C9
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.......................o.............................).....b.................c.......................}.................H...................................b.....l.............................e.........................................)...........(.....`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-27P7L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):739356
                                              Entropy (8bit):5.019903284276821
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25DE0C26D95E19F5DA6B5D71A10EB0FE
                                              SHA1:1C3854692C3D03FEDB106AD330DB9A6EEFC454A7
                                              SHA-256:20F07E78D04C499DBBDD49C6495832FC98B401450EA349F236CB2E2460DF2996
                                              SHA-512:A66A2C29E65394E0DFCDDC393FDED51F18901D2E42879CCA8F3A0020A1F0B4B5F555EDA4CE3AE1318A20CE4190CC3064FF06A2BE6E3CB1C2BFEFB7A6E35ECA3A
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w.....y.....z.....|.....}....................................................... .....%.....>.....[.............................K.....o.......................!...........}.......................r.............................a.....x...........k.................T...........8.....}.....8...........J.....p.....O.......................c...........W...........&...........a.....|...........p...........O...........].................N...................................W.....w.....'...........Q.....o...........n.................d...........N.....r...........w.................S.................4...........k.................m.................E...........@.....u.......................4...........W.................\...................................d...........................................................c...........A.....x.............................C.............................G.................[.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-2N02G.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491896
                                              Entropy (8bit):5.733819464813427
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3AC2084834A61A90B33F64537E3B1F27
                                              SHA1:72DB3F2DAF8EE32CF224D9CF905C2D6E828C2D71
                                              SHA-256:791D2F53FA305B4929A76DEAD75FAFFDC367B5C4CA79CEBBAD71D79FEC0031E2
                                              SHA-512:BDF19FD085035916FC745D00BF9DAEA34D703BC2C6F669D21E39AAD5C8AD05500088878EBBD2B86B80696E93EBF7DE3143DB078B25A98251CA2C8525F6E88141
                                              Malicious:false
                                              Preview:........Q f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{...........................................................................................................o.................N.................6.................:.....P.................1.....E.................D.....V...........-.....c...................................\.......................r...................................b.....~.............................k.......................+.....w.......................=.....^.....l...........5.....n.................=.....p.................7.....h.....x...........#.....O....._.................O.....`...........J.......................I.....f.....}...........&.....G.....m.................].....r...........D.......................].....{.................E.....k.................d.................F................. .................Y.................>.....k.....|.................+.....:.................P.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-2T3UU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):431086
                                              Entropy (8bit):5.412510838847386
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:206FECEE346302A44737681661A419D4
                                              SHA1:0CBB4EDD9CB8EF23746242D16717D2042C3254D0
                                              SHA-256:2D7103F4B60C185F0EFEA040D23F5040C8EE405F6E02DA2B38C894AFC29E0832
                                              SHA-512:C4A8C92F98F6A3D5792DC3CA50BC4552060979FEB269BFA18422B68787505361864CE548D420AED0BF600EEDB64B1EC96860D3DC962AD5F910A52F6E3A2CDFA0
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................T...........G.....\...........%.....^.....q.............................Q.......................R.......................@.......................A.......................m.................5...........B.........................................X.................7...........W.......................b.....{.................7.....\.....l.................?.....O.................N.....b...........".....P.....`...........(.....Z.....j.................F.....V.................B.....P...........:.......................H.....n.................,.....K.....d.................3.....E...........2.....q.................\.......................h.......................o.................,.......................y...........?.....h...........0.....\.....o.................(.....6................./.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-4LO8V.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):602433
                                              Entropy (8bit):4.7884870034691005
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:16970B0DFB5555779A8CE95D96BF97F2
                                              SHA1:432C8BCA1953C5719E4CA4310FA5558436103D6D
                                              SHA-256:C7B170DCF4DD84C2EA8A454C5D82D7F0C9AD9A98127E66263FC3CE0D91952254
                                              SHA-512:D20AFC7C4C648266C96CD38B8A27479884AD1C31C8C9C7B6FF7AEF14331B72EDC2E505BF83A25A767B5889FDF504649140EFF69EF7478A5DF7F04B1F507617AA
                                              Malicious:false
                                              Preview:........! ..e.0...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....].....v.................q.....'.................[.................2.........................................U.....w...........l.................9...................................1.....a...........x.............................g.................}.................e...........,.....E.......................9.................J.....w...........a.................=.................,.................^.....q...........g.................6.......................g.................'.................P.....c.............................{.................3.................2.....V...........M.................[.................S.................<.....U...........8.....i...........(.........................................8...........`.............................V.....}...........i.................r..........._.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-5DN1N.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):400903
                                              Entropy (8bit):6.739635196638547
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2846F59BD7FC670307E900172A74272D
                                              SHA1:9AFD950370B9FDC4831C72864348B8FFAE36B6D3
                                              SHA-256:A1ABC5A22BAC57253082C9BC15645EFEEFE60B4F0A82ECBFD316D620DA49FE89
                                              SHA-512:F38C107FD60DE563A09EBD9A71D6F96F14102DF467C58E51560C274BF426EBB6D5D3EDE6955AFE5DAD17DFDF1227368AB964AC326559DDE5C1991F787C0853C0
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....|. ...}.2.....:.....B.....M.....U.....d.....i.....q.....x...............................................<.......................m.......................k.......................v.................,.....z.......................R.......................1.......................1.......................M.......................>.......................$.....|.................+.............................q.......................8.....^.....j.......................,.................4.....F....................... .....y.......................^.......................6.......................9.......................J.......................!.....o.......................b.......................E.....y.................(.....B.....N.................0.....B.................9.....Y...........B.......................h.......................e.......................-.....K.....[.................;.....M.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-6660E.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673037
                                              Entropy (8bit):5.040592901795516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D5E58828AFDA6783690ADAE466AC3346
                                              SHA1:B716C2D7012C3CBAFD39E62EEF0B4A7BE3691A87
                                              SHA-256:55DA7EC2D2E3018270D67B759EDEDFE11F64BF41CC7C6443E3B07540C78E5689
                                              SHA-512:B5A5522FBC5FB1F31DF7AD7D939A57CD004F5ECC7A65E5E9F567C6543D7591763BC6D541C56FA3663BC19C6314382645AEBB274FBCC7EF4E539A946C3457A126
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...........................................................J.....j.....+...........Z...........].............................9.................J.................%.................h.....~...............................................G...........`.................~...........l...........7...........(.....G....."...........i.................m.................0.......................\.............................l.......................%.................(.............................5.................".............................^.............................+.....R...........J.................?.............................K.................z.................8...........\.................|...........^...........Q............................./.......................H.................6.............................&.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-79C42.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):425311
                                              Entropy (8bit):5.395319539126201
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:44396D9D8F0F0AE4CE756C49D534FD3D
                                              SHA1:8FAB9BFFFCF3B5B7C68C746F32F6A44CC4E1CCFF
                                              SHA-256:AF7200191D8EC87E6A9CE38F40E9B125E6A7896B1531E86773E24F79D82FB47A
                                              SHA-512:67EC69EC2595B6E35D428E0D4E395D1245A2FE9A16556171854F9C6FFB1E8102F8BD90F10996E2F162D7DF00CA94E7E194C56631994F3BDB6B1D92E4F452B23C
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j.....w.......................-.......................a.......................s.................1.................,.....E.............................v.......................j.......................y................. ....................... .........................................(.....>...........&.....o.......................8.....I.............................V.............................q.......................e.......................A.....i.....r.................1.....:.........................................4.....K.......................&.............................d.......................\.................$.............................R.......................R.......................x...........D.....X...........1.....p.................V.......................-.....Q....._.................8.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-7ABIO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):390679
                                              Entropy (8bit):5.489673740325356
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E043647BD2DAE08B42867F76C9F8A7C0
                                              SHA1:00F62CAA07C28A99D3DDF64F1E0D346C1DD0B9EB
                                              SHA-256:A60148B1795518660991015F7083E0CAAC406E9188EEEF7A9675B57CD1424DF6
                                              SHA-512:88AF4FD99880C0AFFE4E3D87C6E34100E0B235E92B2B5C302A6D470521E38C1A783F6FF20D2B4F2DD0FBB708EE4AC0446EAC659BED0D24B77654928E6C330237
                                              Malicious:false
                                              Preview:........s D.e.....h.....i.....j.....k.....l.....n.....o.!...p.....q.4...r.@...s.Q...t.Z...v.o...w.|...y.....z.....|.....}...........................................................................................'.................A.....T.................).....9.................5.....K.......................4.............................F.............................T.....y.................G.....|.................5.....f.....t.................6.....F.............................|.................0.....o.............................I.....h.....r.............................x.......................Y.......................$.....i.......................).....Q.....\.............................~.................).....w.......................9.....u.......................9.....Z.....i.................B.....h.............................l.......................[.......................V.......................}.................(.............................L.............................h.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-7H3EJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):430694
                                              Entropy (8bit):5.456758351557824
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22F9E4FE76C5CF3239DE215AD36D3FCC
                                              SHA1:E71E47F00187A851B1DB6ECC5A2AE2C3F942E039
                                              SHA-256:F8E9C973248868531DF9EB55A914C30E1FB3CA9BC4B6CB7DEAB65BB8919FF158
                                              SHA-512:E8AD9C50CE97F5F0563DDA08B870FAABE660FF4A495EB05173E9A6E6E297668F9BBCB08C73D2731604A221111BFCA4AC0982B3ACD68EAF452B9F19EE68180FAE
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................Q...........H.....c...........2.....b.....u...........W.......................s.......................k.......................Z.......................Y.......................~.................5.......................9.......................I.......................v...........9.....P.................7.....R.......................*.....}.......................u...........!.....,.................-.....;.................%.....-................. ...../.................".....*.................M.....e.................2.....H.................*.....M.................2.....?.................;.....g.................$.....5.................!.....9.................=.....X...........S.................A.................,.................>.....K.............................}.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-8H4JF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1043527
                                              Entropy (8bit):4.426337953995401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6B594588A6292B3D13269C23EA35231
                                              SHA1:3D098299EB245B24E49C3FCC178AE1D09985E265
                                              SHA-256:70A466AD6291A12F75347F552C15650A040D26EB415E04018D5DB25F0CEE398D
                                              SHA-512:2077492F072D0F384A3D9FD6963ECBDDC7A5A680283EBF965ACB888A47E1B4E90312A075A869F9BE51AF9760D4AABC6A5FB266D5F7252F998C35C3AD5211D87D
                                              Malicious:false
                                              Preview:........X _.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}...............................................................................+.....h...........Z......................./.....!.............................v.................%.........................................!...........i.............................Q.......................>.....t.....h...........?.....{.....r...........E...............................................7....."...........'.....\...........J.............................:.....{.................F.......................(.....o...........`.................7...........}.......................2.....v.................b.................W.......................Y.......................@...... ....9 .....!.....".... #.....#.....$....r%.....%.....&....Z'....8(.....(.....)....T*.....+.....+.....+.....-....P/.....0.....0....D2....U3.....4.....4.....5.....6....O7.....7.....8....n9.....9.....:....p;....k<.....=

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-AH8ER.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):489863
                                              Entropy (8bit):5.201818119132309
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3C9C48A7DD48CC2B23055475FE9E228
                                              SHA1:91144E5B4C21C9520B1D61F8E41CE91747D518DA
                                              SHA-256:6EC573C3A957A655B024E23CC8610C4DCE840181F23546FEBE7E8CBA89C4583A
                                              SHA-512:6956C9FA70B4210A3635E6D2FDBB53E2BEBC3A56B40CB783C2D7F820E180E5F4487A766EA8CF0C88EBAC023D3368DB873479D1A4B845DFFADC7653B68CE8FBAB
                                              Malicious:false
                                              Preview:......... ..e.(...h.4...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....h.....~...........7...........&.....D...........;.................=...........*.....Q...........F.......................j.......................}.................T.................4...........J.................9...................................4.....N...........I.................B.................P.................:.....W.................-.....:.......................'.................?.....U...........!.....W.....f...........).....[.....i...........*.....[.....i...........,.....^.....l...........m.................>.......................8.......................(.......................Q.................A.................2.....L...........*.....].....x...........l.................u...........x........... ................. .................6.....N.......................D...........:.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-AJRT8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):432643
                                              Entropy (8bit):5.520056060273409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37BFD002B9A56B236A07B4BFECB6ACD
                                              SHA1:EB7687D66DC7195AEA46CCD52FFEB123B081E3BD
                                              SHA-256:3634CC48474C78ECA269AEBEA00CCE47CEDAEB2C1A522A30EEF3ED0013926923
                                              SHA-512:5D042CC92123F0389012C9618F6EDA666A97DA0FE83EBEF883BD2C032C1E937B9EA0E1F6C4BB5B0CED7E28F6C7BEBD2D9E73D077604DD66F8B1B280DA27A0A73
                                              Malicious:false
                                              Preview:......... ..e.....h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....A.....S.....g.....{.............................G...................................P.....i...........9.....r.................D.....s.................C.....t.................h.................:.......................m.......................w...........&.....6...........2.....}.............................;.............................h.......................E.......................9.......................F.......................;.......................+.......................".......................-.......................B.............................k.......................<.....].....o...........G.......................h.......................Y.......................O.....................................................7.....]...........).....Y.....l.................$.....2...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-AN74H.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):435709
                                              Entropy (8bit):5.427114715109804
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E226109EBF9A43AF5D95F6066B24915
                                              SHA1:076AB0214579858F697D7193847AFC3A046390D8
                                              SHA-256:39D5B787C10047C718228DCFCEDA3576FE9201DB0BB99CC60BA5D6BB5AE48560
                                              SHA-512:132726A998DBF27C410D318CBA7DA9D5F140D612FAF68F1FF5F5A40155C829E387C1CDCDCEEC77441CEE7B79F8634FB090ACFE4F17550806011B2574249AD712
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....|.....}.........................................................................#.....4.....G.....`...........e.................6.......................H.......................o.................".....y.......................W.......................-.....|.................4.......................Y.......................U.......................X.......................x...........0.....F.............................{.......................A.............................[.......................?.....n.....{.................C.....N.................-.....=.........................................8.....P.............................k.......................a......................._.................!.....i.......................3.......................4.....~.................W...........$.....9.................6.....R.................<.....N.............................W.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-B7A33.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):477276
                                              Entropy (8bit):6.165762910369141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BDFB8A270C4B8786C8FC2B8A1CB60BAB
                                              SHA1:EC240169AED1CDC91030298C63824C053DE51205
                                              SHA-256:1CBB36AB058A27954F4BA1AF2778A4164FFA1719835C8A8E721722A3837233A7
                                              SHA-512:E22F7109C4DA972E4C138B36D30D3D589058E8418F260707D013A4A28F7D444B1C0213626DB1A8F2A3B9BB83467721493C26FB6C8A4D3305FC5CD9FCD1D42FE7
                                              Malicious:false
                                              Preview:..........1.e.....h.....i.....j."...k./...l.7...m.?...o.E...p.L...q.R...r.^...s.o...t.x...y.....z.....|.....}...............................................................................!.....4.....D...........8.......................x.................B.......................s.................0.................#.....3.................&.....9.................).....D...........".....W.....k...........&.....T.....a.................D.....Q...........#.....[.....k...........n.................7.............................e.......................@.....e.....u...........Y.......................w.................%.......................,.......................).......................G.......................z.......................j.......................u...................................3.....c.........................................................................................X.....f...........?.....p.................O.....~.................D.....d.....w...........9.....h.....{.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-C1S8J.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765340
                                              Entropy (8bit):4.963754533847095
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F7AF63DF54FD846C16B3C97E588FD3F
                                              SHA1:7622045E2EA5D5A690A814873AC17B3CE57E6035
                                              SHA-256:EC13F5B2DAE5F7577F482762A47D2120AE318AFB2D35A073D809F740F6937BFC
                                              SHA-512:EB0B6C23A4A28049FC0E9F8AEB3639AEB36CE6A0AFAE570680FC9EB7752F8571AC8F06E92EFCC325311CE4BB0C4DE7E54C2F2CBB7109F451D67EAF0179F187BD
                                              Malicious:false
                                              Preview:............e.T...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j...................................d.......................F.......................w...........'...........5.....z...........c...........k.................@.................O...........A.....}.....p.....3.......................@.................n...........O.....t.....,...........V.......................".....P...........c.................Q...................................0.....M...........R.................V...........0.....U...........X.................2.......................u.................4.....F.......................G.........................................$...........?.......................a...........*.................9.....K...........z.......................2.......................U.............................N...........L.................'........... .....Y.....r.....J...........g.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-CDLUD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):462528
                                              Entropy (8bit):5.606577668939973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B678783C319BCB892F839440A469130C
                                              SHA1:889D5379B23D8CBCA08968E469242E73725025BB
                                              SHA-256:045A38565C995C9B1F428295392F77052171BF4B1E7B327B921061C2BA7259FD
                                              SHA-512:18E8AFA27EFD25F87421A2CB5E9F34983D932AC61BABB171930BFBDA1186EC55BEEBDF110CA5BFBCADEC53D3EC41AF157E4FB7A2ECBE3B807AF1F12DD52355C3
                                              Malicious:false
                                              Preview:........^ Y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.......................................................................................................>.........................................W.................-.................).....<.............................{.........................................4...........'.....j.................L.....~.................C.....m.....}...........i.................C.......................{.......................{.......................x.......................x.................!.................'.....8.................+.....8.................$.....0.................).....6...........;.......................h.......................[.....}.................B.....z.................c.......................l......................._.......................s.................z.......................4...................................`.....|...........@.....p.................^.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-E4IU5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471567
                                              Entropy (8bit):5.354079420195156
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2BAF163FA95FA30FC29E2E5871D24CBD
                                              SHA1:9381B41FFE7EAEB7B269FEA54160BC6AB7871548
                                              SHA-256:EAA363739EC52548F4A32F9C6ECE214FE5534AF8A0597D271F6AF26AB2263B44
                                              SHA-512:B053B7503C1E650B2094DB6003B93ECC9A34E0847312B418AE813036644E4DBCBADEA914F546EB4753C3B30642A9664B737D4F9C3F4DE6602112A1F67511725F
                                              Malicious:false
                                              Preview:........> y.e.j...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................X...........L.....g...........?.................0.................+.................Z.....u.................B.....U.................:.....K...........E.................D.................".................D.....W...........,.....j.................m.................h...........@.....g.................-.....H.................!.....0.................(.....>.................`.....s...........7.....u.................-.....^.....i.................B.....L.................Z.....j...........]................./.......................9................. .....w.................H.................@......................./.................%.....>.................W.....q.........................................P.....~...........d.......................U.....x.................|.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-EVGMA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):443233
                                              Entropy (8bit):5.354406946962274
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9FF1D4EB5F94297FDB8619004C0CACF8
                                              SHA1:FE149C387C18D5B2F63A30C49019E7FD8AB913AB
                                              SHA-256:6DA873B61E1DD29ADE307EB1ACF1834728CFEF98CC701A475CD360E493380380
                                              SHA-512:89BC1FACD343FD35BF1C10994422826E97291634C9DFF45CE55F7BF620261DED041F9F8FF3AADE4DA082B915212594F45C99133BC20274C660DBD6B1FB7894B4
                                              Malicious:false
                                              Preview:........0 ..e.N...h.Z...i.k...j.w...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.&...........3.....;.....C.....K.....R.....Y.....`.....a.....b.....d.....p.......................1.........................................0.................\.....r...........?.....u.................7.....`.....o.................C.....Q...........).....`.................Y.......................n.......................}.................;...................................C.....\.......................3.............................U.......................D.......................F.......................+.....~.......................].......................R.......................q.................*.............................f.......................T.....|.................`.......................e.......................[.......................p.................V...........,.....=...........+.....m.................].......................F.....j.....z...........<.....j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-EVGVS.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):834421
                                              Entropy (8bit):4.876465138992703
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EB779878D14C459E60B04FE3154AAE6C
                                              SHA1:781A2502679E3464B2DE04319A17EB123B38F589
                                              SHA-256:0784AE7F982172A3F0C9FD654A3781D263F98A01AC702291D404F70DD7AF371E
                                              SHA-512:527CDDA3CF3EF63EF6331AAD0A68572F1276A9CB6A93E8931A96FF90974E818549E96DD6A8963222C5DD67BE7D2910B46619E609A8DFD9EC8BB955AA88051F7F
                                              Malicious:false
                                              Preview:........8 ..e.^...h.j...i.r...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.......................(.....O.....-.............................p.............................`...................................%.....{...........A........... .....@.......................g.....o.....i...........8.................I.....d.....K...........y.................P.................:.....2...............................................V.................d...........R...........i.....C.......................o...........................................................$.............................%.....-...................................,...........U.................g...........U...........o...../.......................R.......................B.......................m...........&.....P.....k.....!.....Z.....[.....B.........................................u ....?!.....!.....!.....".....#....P$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-F3EF8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):466574
                                              Entropy (8bit):5.393834079901674
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:072E2BF5C2C23C26A342B1CD5090ADB0
                                              SHA1:F60997D94FDF3A2A3892722750E8533B7D68CC59
                                              SHA-256:ED87A5C64BF2C5D57A2DD7B71C8A338E0A5402AD7B6EE731773601E885FD01CF
                                              SHA-512:DF8B3407AA31D3E46218D2E277359E32BF3C6623A54CD2400743BE6432210FCCBA82E92EBDBCA0F44F322A4E7BA7FF4522E779816E992BF40C08E426BDE498D5
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................n.................T.................=.................8...........#.....g.......................X.....h.................<.....N...........<.....~...........".......................\................. .....{................./.................M.....b...........X.................-.............................r.......................u................. .......................(.............................i.......................B.....o.....y...........0.....d.....u...........S.......................c.......................(.....B.....S.................D.....^...........7.......................M.....w.................7.....m.................C.................1.................$.................[.................b.......................V.....{.................^.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-F8KS1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):470778
                                              Entropy (8bit):5.34217037343731
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E004770D6760C02517131A19939E118
                                              SHA1:A326BB7848CAA86E7E07A5D4986C31348EC8CC50
                                              SHA-256:A687A109FF23A4A7CDD422BE9419987D942725E289856A65129C0499199E4DFE
                                              SHA-512:4DCFBAF81006095B2C4E0EC98F94294A01EB45A1D42A933067AF9110FDD6F14EFECB1F8900FE541F772D66C60484C9AE6B644C7852364486B0072D7F132423EA
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................c...........[.....v...........X.................D...........4.....N...........1.....m.................C.....r.................D.....l.....}...........w.................k...........$.....B.................].....n...........>.....z...................................{...........?.....d.................L.....b.................6.....E.................>.....T........... .....S.....f.................O.....[.................9.....D.......................&.......................#.................X.....r...........(.....T.....q...........".....I.....h...........O.....t.................|.................a.......................U.......................k.................&...........:.................=.................1.................U.....i.................4.....G.................X.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-FMGA0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):956384
                                              Entropy (8bit):4.455345909186297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D78D3F526EDCEF1C7923475F99DDE3B2
                                              SHA1:613FC2E4B43DDCCB4EDD2F16903C3860B8563188
                                              SHA-256:86B9C50EF9CD617F969AB66F1DBB4F95A6A2E7EFB588707403F35B4E84330B6D
                                              SHA-512:0EDF39DD4F11F29E6927F88FA13CD0059E1C59653E0833F1FD21266D2E764D6FC127D9C3541A854D373E25F6949094B91ED83A18F9EDAB7BA88E93E6D0198129
                                              Malicious:false
                                              Preview:......... ..e.J...h.V...i.p...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....l.............................R.....O..... .....\.....O.....................................................Q.......................7.................b...........L.....l.....O...........j.......................F...........^.....2...................................'.....$.....................................................$.....`...........@...........5.....]...................................................................................m.......................3.................Z...........e.......................L...........;...........B.....k...........p.................q.....R.............................d.................).....l.................G.............................#.....V.....}...........x.......................,...........l.....8.................. ....c!.....!.....!.....#.....#.....$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-GB0M2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):508122
                                              Entropy (8bit):5.631450824927112
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BD724FD924C465E0335F444B09413970
                                              SHA1:E5A630E412985FC9393456F48869EC6B4286AC3C
                                              SHA-256:18DA515A2174A5FE97F0DDF58AAC49911BECDFF848D0AEA9C7A3B22E526C548D
                                              SHA-512:F2A8937DCD17FEE6ED92380735A94123CD19C8EA967C1E8BB6747A482B68FBE47A08AE8482C92E2DAA688509BAE78F0D5E51FD5FDF4940770FBE6354AFFD0251
                                              Malicious:false
                                              Preview:........$ ..e.6...h.B...i.S...j.]...k.l...l.w...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...................!.....).....1.....8.....?.....F.....G.....H.....M.....].....s.................J...........k...................................\...........B.....\...........T.......................}.........................................q...........#.....T...........{.................i.................0.................Y.....i...........l.................a...........M.....l...........`.................................................................g...........C.....Z...........d.................4.................!.................M.....b...........h.................9.................4.................?.....[...........&.....R.....{...........B.................*...............................................w...................................Y.....z.......................*...........Q.................i...........0.....L.................K.....g...........X.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-H9AH2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):397474
                                              Entropy (8bit):6.746352572041569
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D91E515657D4A3AC135214B6152BDED5
                                              SHA1:26EF564AB9326BDE96C038B769F110F80BB01BA0
                                              SHA-256:4126E6EE9F924F86046ED00C410B37543545EFB4D0E99E4FA472987D108B4CFE
                                              SHA-512:7B3A361C1ECC11A36EA9D92C4FE1DB85F3F53B1656B145289224A85270535E35A3E3E791D23D331A2DD09EBE18ED190A16FF230B56A8CC327E090F69EC6CBB11
                                              Malicious:false
                                              Preview:............e.^...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....M.....T.....[.....].....b.....k.....w.........................................(.....}.......................r.......................f.......................M.....v.......................?.....L.................".....<.................(.....=.......................+.....~.......................m...................................+.....=.............................;.............................R.....u.................,.....U.....a.................2.....>.................!.....-.............................W.......................H.......................>.............................J.....d.................H.....Z.................8.....[.............................\.......................G.......................P................. .................'.....<.......................'.....g.......................!.....t.......................f.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-HIFRC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471606
                                              Entropy (8bit):5.271836469512455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DDA6C80D323CF717B7D596292ED60628
                                              SHA1:22193A23952ECC7F37AA5DB98AC369B7E1AA7508
                                              SHA-256:622EBAC5319BE333D3415DE6571F79D48A23792B6E9DAEB4080B492EEC99D8DA
                                              SHA-512:741C817CFE404C96BDEAE902A6CE1BA77179742593202E3276F81473E7957A557C7AB40E5275469F41186F25D977F3811FC5714B9A7907776E91E929F879E8FA
                                              Malicious:false
                                              Preview:........E r.e.x...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.#...y.)...z.8...|.>...}.P.....X.....].....e.....m.....u.....|...........................................................q..........._.....{...........@.....................................................O.....x.................7.....E.........................................4.....^...........V.................@.......................a.......................~...........'.....@...........:.......................[.......................?.....i.....w................./.....:.................D.....V.................2.....=.............................`.......................9.......................B.......................n.......................=.....r.......................L.....x.................i.................K.......................&.....d.................2...............................................$...................................?.....U.........................................".

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-IF5OM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471753
                                              Entropy (8bit):5.511235500490613
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA4907C0D4CDFF16C22294C962A8400
                                              SHA1:4D60838FE85A2E02269D107DFAC82E9206202640
                                              SHA-256:FACD97D583B2047C4AF1C230F77ECB031495376840229E0CDB2AD463F3EC7FBA
                                              SHA-512:23FB9358B57FB313CD76CAC03E19E2A40074ACF37CE23F8138C1A13FD571EDC8C80AFBE9172CBDC2DE367004E05A7E34B26F00B13BA17DB003B3A9321C7B207B
                                              Malicious:false
                                              Preview:........S d.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...|.Z...}.l.....t.....y...............................................................................................o.................\.................-.......................{.................2.......................................................................6...........3.......................u.................5.......................W.................1...........J................./.............................Z.....|.......................@.....P.................J....._.................<.....K.................N.....c.................6.....F.........................................i.................$.....F.....c.................).....I.......................6.................[.................7.....\.....r...........?.....q.................k.................c...........>.....P...........8.....v.................].......................:.....X.....j...........F.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-JDM55.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491754
                                              Entropy (8bit):5.793671440598259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:56F9681FE00C2C813332B540349B8C26
                                              SHA1:838EA31D9C62413ED2F9A1001A9DE6CDFD629585
                                              SHA-256:5C6239569CF39699A77AEC0D6E418EABCB1E4A5B1C504676B9C9729B59214480
                                              SHA-512:2D204D9C166CDA23E9994EAF5593B017CC8E2337F6D5F9BAAB86548F04CCEE04C12E85E15149C8B1F99A071CDAC0AF1F20DF1D9F0BB91595B93C45CD7D99123E
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...|.;...}.M.....U.....Z.....b.....j.....r.....y...........................................................~.....#.................'.......................q...........E....._...........0.....i.................O.....~.................J.....s.................`.................U...........!.....D...........;.....v.................r.................E.............................;.......................].....}.................S.....y.................L.....s.................e.................#.......................8.......................I.......................h.................)...........C.......................F.....a.....u...........*.....F.....[...........%.....].....m...........j.................?.......................C.......................c.................*...........e.................`.................).................).....=.......................".................[.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-K5CTN.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):678188
                                              Entropy (8bit):5.164547717738943
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0B950CEF45650A2BD1591C494ADE1D6F
                                              SHA1:DC2AAB36C670E1962BA10517769EDE124BAE27F6
                                              SHA-256:21CF1181DC3002C1BCB1B58127FB2F778F01E6277C73611868AC0B55B95A2633
                                              SHA-512:5DF42AE149E302E83E297D872E6F3B71E064E582ADD7A231D3889936485EE0339AF259F2EB51A1DAC464082832039B55B36CEBC55093A5CB42F68163F850A02C
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.$...p.1...q.7...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}.........................................................................#.....M.....t.....Y.....*.................~...../.......................?.......................h.......................-.....s.............................&..........._.......................1.....}...........;...........'.....C...................................e...................................0...........9.....m...................................o...........E.....\...................................".....i...................................d...........4.....V...........|.................|.....+...............................................J................._...........L.....l..... .................W...........M.....r...........G...........C.....e...........................................................0.................s...........i...............................................l.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-KTV82.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1008891
                                              Entropy (8bit):4.429572949324661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1E0B6E2E70F684C3D31795392F445E0E
                                              SHA1:D09B97D9D82119CBDCB2DC54816A0036B0188871
                                              SHA-256:D3F548279F8FA875B7F9918C19BD0D2760CBC126682E1270E3CB90D780A6EE50
                                              SHA-512:FBB275084BB3D6F62A5D0965AA56982E55D2B9471AD54670433421E2F5DFCE3B32EC4DEC75F235B907A436A0329CD0739F492ABEB5B38E349EB03F6F6A31A012
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................*.....O.....z...............................................?.....z.........................................^...........`...........n...........V...........Q.....t.....[...........^.............................\.....6...........f...........v...../.............................\.........................................Q.......................:.................K...........%.....>.................:.....k.....*...........<.....[.......................'...........z.......................Z.............................d...........P...........H.....t...................................F...................................s.....'.................5.....).............................y...........R.........................................c.................. ....V!.....!....."....^#.....#.....$.....%.....%....\&

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-L53JO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):463221
                                              Entropy (8bit):5.420005926145208
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B90235085171D3331791C016D3C9B22
                                              SHA1:8342C7C34EE6824D6E124ED16F6F9CE93B1AA8C5
                                              SHA-256:F5D1F8357CB40F5C8E3B84C2FADE5B41636A931D4B047122489BD0443A43E1E7
                                              SHA-512:264186B540D55629C4CC44AF4FC4D0F1F096F575250FC16FC6621299842367DB424595FBA4F0CCE63812ECEE563966D100AD7B7D0C7346BB60C2159E09FFE4B4
                                              Malicious:false
                                              Preview:........H o.e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...|.D...}.V.....^.....c.....k.....s.....{.................................................................~...........f.................I.................%...................................-.....B.......................".....x...................................T.................y.................T.......................y.................*.................e.....~.............................O......................./.......................-.......................0.......................3.............................i.......................C.....q.....{...........8.....p.................|.................:.............................U.....{...........,.....W.....o...........h.................L.....q.................R.......................m.................W...........+.....A...........B.......................i.......................A.....g.....|...........T.................".

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-L8Q9U.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765476
                                              Entropy (8bit):4.7975051327532885
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D67EFF3B26F9936A13D7D5D0570F80B
                                              SHA1:FF49B010D1723EC7AB625C8C586906F27AC09C82
                                              SHA-256:854BE8369C455D8321A8784FC4957CF402D75178F9CE74F7C131CD68E85CF6F2
                                              SHA-512:71C6F7578457DAB046142E39B7EDB19A362B712E81DEF3A0E4BF94E44015930A3CA24EA83A76E03A4EC65DB73EEA389E1AB8C2D78F93CB239F701845AFCE65E0
                                              Malicious:false
                                              Preview:........? x.e.l...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....|.........................................y.................1...............................................u...........<...........g.................l...........D.....j.....V...........v.............................T.....>.............................2.......................s.........../.....B.............................+.....j...........8.................C...........h.......................%.................N...........".....A...........T.................M................./...........b.............................c...........?.................=...........E.......................].........................................2.................'.........................................!.....V.....F.....!...................................g.....2...........%.....].........................................N.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-LMV7E.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):393882
                                              Entropy (8bit):5.483434307919725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B7B76968BD06518708C4EE49057C3C21
                                              SHA1:C709EA98C29253F44C4535D69CEED0C7A5A10D89
                                              SHA-256:AE3EA3E3C6AEBC3B2A117E3260DB57920A300F53234347C5C994A6667697A7B9
                                              SHA-512:538063408F1F8FE5294763AEB28EDBE3F7AEB09D14BAB32C67CD117B56DF9FCF13F8A31D4C74E8757B5CDA550AF4BA99C9BF6E26E75A6B1FDFAE036628BA1E29
                                              Malicious:false
                                              Preview:......... ..e.6...h.B...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....b.....r.................W.......................U.......................U.......................K.....z................. .....I.....W.............................h.......................G.......................9.............................\.......................+.....W.....b...........+.....m.............................!....._.............................B.....c.....o.................I.....\................. .....,.....u.......................6.....z.......................;.....d.....o...........*.....h.....}.................-.....C.............................M.............................d.......................;.....V.....e.......................>.......................3.................M.....[.................N.....k.................9.....H.............................Z.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-MK99A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):542659
                                              Entropy (8bit):5.812552118931453
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B6AC1037F684BD0F61BBA25D03DD493
                                              SHA1:44AAE042D51BC1F726A56911BC71D9862E640062
                                              SHA-256:502E1846C3CC6CE0484AF890F92F69CDFBF0F5A98B8211CD551C03FF858A1A0F
                                              SHA-512:BC290D62E563883ED04CA4F4F5709DD1ABAF139D11A54FE5E3E44DA807C194B85778795058A474C87166FC0442C9B2F1FE22DA20353CD764A46AD850B9BF9E55
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....|.....}......................................................................... .....1.....Z.....y.....1...........O.....k...................................$.................9.......................t.......................i.............................:.................w.......................C........... .....2...........1.....}...........9.................F.......................&.................!.....@........... .....J.....[...........;.....w...................................P.......................e.......................z...................................=.....O.........................................I.....h...........=.....g...........^.................]...........Y...........#.......................q.................>...........8.................W...........m...........F...........D.....~...........g................. .......................m...........U.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-MNTM8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):934541
                                              Entropy (8bit):4.4365640897236505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EAB367E9F45366FF6182DE9C989F0EAC
                                              SHA1:EDAE15CE3933672F25B73730B5E1FD9871F2B262
                                              SHA-256:208B8DE31DA311B8C720284A46D045DB952740293A2C01E2C3CFFC6A97CDA7A5
                                              SHA-512:61219D0B26D039F6996A8433B260FF059858CF872A28A462A6948F99B88FF288FDBEDD1E2523DA341E244C91FDD9FF4C80C72C202D746CFD2ABD59D202602F11
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................".....).....*.....+.....0.....R.....t.................7.....o.....-.....i.................\.................%...........L.....R.....O...................................8.................8.....X.....b.....@.................z...........................................................u...................................d...........q.................{...............................................\...................................:....."...........a...........T...........u...........X...........q...........d.............................!..........."...................................H.....~...........l.....2...........................................................W.................. ....R .....!....a".....#....G#.....$.....%.....&.....'...._(....i).....*....w*.....+....^,.....,.....-.....-................&/....G0....;1.....1

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-MPG1E.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):447763
                                              Entropy (8bit):5.433512556683707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4B255615C23E814B83D07D2589B6873
                                              SHA1:E5F1BDE47A801CA0AC3301A91FF1777AE4CD521C
                                              SHA-256:C37B702D42F00B85986B914763323B13E125135A1DD6D70EB061AB818C6963A7
                                              SHA-512:BC35E233DA11563D508E5F4819AA1CD10BCB9F64897F569E4BF2256237A271795FEDC9CEA5B528D26466AE95E8E0127DC69EC90280D776E28C2E55DE31E277AC
                                              Malicious:false
                                              Preview:........= z.e.h...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|.....~.............................:.......................o.................6...........B.......................{.......................n.......................V.......................W.........................................U.......................|...........!.....5...........>.................;.................9.......................(.....v.......................O.......................:.......................@.......................9.............................x.......................a.........................................R.......................6.............................g.......................|.................L.......................L.......................d.......................`.................&...........7.....m.................h.......................B.....^.....k...........-.....d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-N2SFF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):454700
                                              Entropy (8bit):5.349003712537203
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0CEEBA9BC94F6430729C85AD9106926
                                              SHA1:8A268A2EA070E4D5BE6B0C19C41E01EEC4BA0D72
                                              SHA-256:53EDF339033BB99EA23BE682C15ECEBE6D78C4F8B64669E74B7008FB076DC678
                                              SHA-512:121536514ADEFAAF15E5232A4F70A4787EC428E123FAC9DAD5C6EDF5C2FFC5A112C1936D1FAE3C954AB11BBF52BB043C1B3AD5CE135886279CE69D5C05254F40
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.............................A.................&.................4.....F...........9.......................R.......................C.....n.....}...........(.....W.....e...........2.....f...................................a.......................o.......................p.............................,.......................L.....t.......................@.....I.........................................C.....Q.................6.....H.................I.....T.................+.....8.................+.....4.................^.....w...........*.....V.....r...........4.....e.................F.......................n.................D.............................l.................-.......................l...........A.....U...........7.....z........... .......................R.......................t...........'.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-N3IOC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):564410
                                              Entropy (8bit):5.833338590437962
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ABC924058F1AD7A374677AEAE49A12F8
                                              SHA1:948F5F2600A23F93F1D30A38408DEE80D7C5A5E2
                                              SHA-256:B33F0FCBD0B4A2BFE49E4607C0CF25B93B99A0AA4BF6A337E1EF6A7842748D3F
                                              SHA-512:C813567EC1776B20933912176EF0D4050F972ADC24B6EC9151C4E390EB696650773914F10502876B23ED5660547672810C6D4C64659DCB169706817BA4ECCBF1
                                              Malicious:false
                                              Preview:............e.6...h.B...i.M...j.V...k.g...l.p...m.x...o.....p.....q.....v.....w.....y.....z.....|.....}...........................................".....*.....1.....8.....?.....A.....F....._.....}.................Y...........7.....U...........K.................;.................9.......................F...........6.....g.....y...........G.....t...................................n...........2.....S...........3.....f.....v...........Q.......................r.................a...........c.....~...........B.....d...................................o...........7.....X.........................................`.....o...........k.................5.......................~...........J....._.........................................F.....h...........M.................%...................................X.................J.....l.....{.............................U.............................G.................\...........*.....K..........._.................E...................................b.....}.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-NVAIU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481152
                                              Entropy (8bit):5.445989518263063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72F4A085F0FF9435A99E52CE890710ED
                                              SHA1:D5AC32EB03273B8463D42EFA97712DBE9732B28B
                                              SHA-256:74589FEA8304CB7DA427AB5E5DC71E18F3B1096A0C62B5569B539A08BADF6D6E
                                              SHA-512:29BB40648A59277F35F5AEBD321D6F5C2666756A821F67ACE74EBD222BC3B2A0F4CD2B138C0CEF008AD76D6019095F54D61C9B30AB4ACF64F3ED508B13FB3A03
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....}.......................;.................3.................-.....A...........H.................9.......................Y.......................<.......................K...................................F.....j...........H.......................l.................'.......................x...........H.....v.................3.....P.............................p.......................U.......................R.......................?.............................e.......................M.....|...................................G............................._.......................d.................1.......................n......................._........................................./...........,.................!.......................n.......................r.......................t...........3.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-NVHS2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):717149
                                              Entropy (8bit):4.90268618853934
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CEB5A570B85F1E7A385D7D3BBDC71A04
                                              SHA1:943B103639DD738DC17365DF90EF0B27BE35A728
                                              SHA-256:9BD132621993B3F2FE15A4BB8DA7A791A75CD340A0A819FFC2258E1384F2A58D
                                              SHA-512:0CC08A9FFA0940DEC5A740012997BD1D5C1F38A2106C125D63B8F7F4608EF1E6E7EA5926ADB49C0316D34CFCC9E80E5E6DC189740A93E0DC6DC77988959CA12A
                                              Malicious:false
                                              Preview:........J m.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...|.H...}.Z.....b.....g.....o.....w.................................................................?.....,...........m...........e...........r.................[...........#.......................I...........x.................w...........4.....K.......................G.....G.............................-.................v...........o...........z.....1.............................i...........6...................................>.....a...........^.................y...........z...........I.................?...........X.................Z.................>...........m.......................[.............................=.....e...........t.......................&.....s...........`...........S...........F.............................f.......................G.............................K.....i.....W...........p...........t...........S.....t...........o.......................=.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-PHCCM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):970497
                                              Entropy (8bit):4.416502608555437
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11AF78A74835CB6CD030453E00D48320
                                              SHA1:5801BCE64FAD3B107BFFBB010D911B585214D281
                                              SHA-256:79588276DA84298C19C112AE665D01362524A775436FF85AFD9F3BA65CBCCA85
                                              SHA-512:38BAEAC624A95659AA06CC2A2C60521D874CDD6CDB9B1290C458A771B1F25D085711387303E13B5078588C46653FB3E9DDF73512FDD7DA88359AFD50A0A85F68
                                              Malicious:false
                                              Preview:........+ ..e.D...h.P...i.a...j.m...k.|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....?.....G.....N.....U.....\.....].....^.....c.............................?.....I...........A.....6...........................................................D...........@...........m...........Z..........._.............................s.....Y.....0.............................Y...........U...........g.............................K.....o.....g...........a.....*.................;...........s.................r...........7.....Z.....:...........S...........O...........K.....w...../...........#.....I...................................R.....................................................`...........=.................8.................3....._.....G..... .........../...........z...................................!.....$...........z.................9.....,....._.................= ..... .....!....A".....".....".....#....{$.....$...."%....(&.....&

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-PRD98.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):883611
                                              Entropy (8bit):4.488277211018212
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1D7AE2CC0781852DF5AC948E761889B
                                              SHA1:9FF5B70558C26FF0C4A0A234DF662A9B5B00D11B
                                              SHA-256:1DF078BCD2D0FA247B1031A88CE2EFF27BACE693F8B85617D22E13E8DA21B73C
                                              SHA-512:825D13E218FF433C478188A4ACC90F84DD0D216A3F08A389091CD2DB3B2528B26BD75B143BB9F23BF02E21ADA7229093F85BF4ACF2A573F6DC8C8796521D6897
                                              Malicious:false
                                              Preview:..........!.e.....h.&...i.....j.9...k.H...l.N...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....|.....}.......................................................!.....(.....*...../.....S.....}.................3.............................X.............................`.......................U...........H.................6...........R...................................z.....q.............................J.......................^.......................l.................>.....-...........+.......................0.......................8...............................................9.................,.....P.................=.....d.......................'.......................D.....^.....[...........G...................................B.................`...........G.....w...........L...........R...........g.......................4.......................C.............................................................................@.....p.....&.................8.....A .....!.....!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-Q16TB.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):484288
                                              Entropy (8bit):5.8243114746271765
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:485EA7CEEE6AE86812D834B6AF09B9CE
                                              SHA1:72F04594DF8C55EF4D3A9480FDC91320A7795C05
                                              SHA-256:66BFD87719482196D0A92D46DE25EE6E76B33CEFC8722748377444D7C0C637E6
                                              SHA-512:1734378C3680A5A544A24671D439C7D6F11F54A2382A8F77D7A937FAACE1018D8900128815438BE1973C26209A8CBD02908712535275A7CD7ECB2675DB2EA769
                                              Malicious:false
                                              Preview:......... ..e.*...h.6...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................%.....,.....3.....4.....5.....7.....G.....Y.....k.............................-.................&.....5...........8.........................................C.......................?.......................B...................................Y.....{...........b.........................................?...................................M.....g.................6.....M.......................0.............................n.................".......................,.....}.......................r.................#.................,.....@...........5.....y.................(.....C.....W.......................8.................+.....A...........!.....b.................?.....Z.....n...........Q.......................p.................<...................................f.................j......................._.......................r.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-QJSJG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):440491
                                              Entropy (8bit):5.26850729829571
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:47C581BA86F8E8ED064C6F2C2528E39C
                                              SHA1:F5F78898490A2A355BBAE157EAB716B29F755C81
                                              SHA-256:57F48C9B4DFCD9406909230689C9C0028704DF2D708F9CC30E92CEAB244C6E39
                                              SHA-512:DE989540872F75022E9963BDCDBCED7CFB393FD5CE5F860A546AB946A00F9253500032B3A8F214768829829C0CA666A3BC967A39331D00BB9B10393EE3BCCFEA
                                              Malicious:false
                                              Preview:........T c.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.+...w.8...y.>...z.M...|.S...}.e.....m.....r.....z.........................................................................................[.....w...........6.....j.....z...........X.........................................9......................./.......................1.......................W.................(.....x.......................U.......................C.......................`...........-.....?.............................I.............................o.......................i.......................q.......................g.......................U.......................H.....{.................i.......................j.......................J.....n.................'.....P.....a.................E.....h.............................}...................................#.....<...........3.......................d.......................q.......................A.....c.....s...........!.....N.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-REI0K.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507620
                                              Entropy (8bit):5.627043956013093
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37274D5FBCD7DFD0778ABFA2F95AC435
                                              SHA1:603B198724776B3284D202E4042EB24ABDAC3CC4
                                              SHA-256:5078AF2EF4D000CD3D8E886B907B2BA279D71477D7012FE3E54629CA3898E0A9
                                              SHA-512:962C8B533D2FBC2E6C668CB7FAA158170D534D35F2727861E27B360F25B7E83DC071B4460C93743BB1A5BB1E38CBEB975A97DC62EBA13E5861200FD1F77874CD
                                              Malicious:false
                                              Preview:........: }.e.b...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................N...........<.....W...........m.................g...........A.....[...........R.........................................[.............................(.....\...................................l.................-.................U.....e...........}.................n...........L.....j...........L.....s.................q.................&......................._.................0...........$.....^.....m...........k.................7.......................m.................)...........\.................@...................................K.....s...........e.................E.................5.......................A...........h.................[...........".....F.............................~...........@.....`.............................B.......................b...........2.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-RL3FK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1085178
                                              Entropy (8bit):4.3593010164581925
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15A61AD50E2FB3833AC6A393A73F8488
                                              SHA1:6F603577883B716F792301F8FFFDEFDE3ACD8FED
                                              SHA-256:D08672BCEBAAE44591C08AA57C5B3511E0760027A39B6EC13F345F9DCB7C2BFB
                                              SHA-512:25E1473A54D9288C96BF64CDF7FCF5FC9E695A1A11A048143AAA83C3308AB215A1E0B362E257662B3D2D6E736C45A0E4BC8126A67E0D2274E0A9C8F236B62EC3
                                              Malicious:false
                                              Preview:........I n.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....}.....................................................G.................F.....G...................................^.....x.....R.................r...........O.......................,.................c.............................z.......................!.....'...................................K...................................t...................................e...........V...........;.....N...............................................Y.....-...........b...........9...........\...........`.............................>...........................................................G...........j.......................I.................0.........................................F.....v.....B...........! ....v!....2"....."....M#.....$....4&....2'....g'.....(.....).....*.....+....L,....1-.....-....$............/.....0....@0....s1....\2.....3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-RQ2US.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673161
                                              Entropy (8bit):5.277859283772137
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:93DB2C0625CC25A0160268DF1E8D7DB0
                                              SHA1:63460D6C4A93F8DBF55A768F82B61A202186198C
                                              SHA-256:AD15FB814C172D8526DF00B7B130435F3B14581116F9FDD6368593E6AA2D128F
                                              SHA-512:C258819E2E84F771533E66BB3F82BBF68E23E0FDB1CEF7DC655E058DA6ED5612331AAED8BBEF55AB1E37D135BB8D754F1F9BE4E6687695D21C20662254FCAAEB
                                              Malicious:false
                                              Preview:........; |.e.d...h.p...i.x...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t...................................~.....................................................9.....n.....!...........(.....L...........W.................Z...........&.....I...........U.......................(.................l...........\.....{.....#.................<.................I.....u.....S.......................N................. .................H.....j...........S.................K.................=...........\.................^...........%.....A...........=.................(.........................................*...........:.................0.......................y...........9.....Z.....!.................\...........].................i...........D.....j.....<...........6.....g.....7...........n...........v.....#.......................C.................m...........).....V...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-SS759.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):475865
                                              Entropy (8bit):5.477217061104823
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48D1A0F19DA57879F019D8B158574D97
                                              SHA1:F642DFCF4FA4EC008EDFE6A170350C0FCC7321D2
                                              SHA-256:7378E9E25C132B86D049D94A8284229F164CC3AD8C8E2426262172EB63C09BB3
                                              SHA-512:4061FB292F090108D7CF2DC05279A602E08D6F1DA3A85B5738BDE48AFB59F32BEC1D1871083E647FDE1881C04E3C0480EE372EFD62D89A8EE2B4A5169D21BFBC
                                              Malicious:false
                                              Preview:........* ..e.B...h.N...i._...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....h.....v.................+.................&.................-.....>...........J.........................................#.............................r.................'.......................g.................3.................K.....a...........5.....l.................z.................k...........<.....b.................(.....@.......................%.........................................<.....P.................J.....[...........A.......................S.......................W.......................s.................*.............................d......................._.................0.......................a.......................Z.......................z.................,...........v.......................6.................5.......................1.......................#.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-UJRHE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):763471
                                              Entropy (8bit):4.999444806602008
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D03AD4371302B7FB9453E56E95D8781
                                              SHA1:4AD2A331D6F7D2D82D0F54328CF9A29F5CF8154E
                                              SHA-256:1395F97A60BCF82321118878292533103DEB43EE4823D6F7114F3F0D405EEC0A
                                              SHA-512:FCC24303E43039860EADD9D65BB790395AE706CF28358241D91BFE7E6C62E87F8A70E0069183208CB3681412D5AE8245891605CEE93C0DCDDDD91367168890CD
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.#...k.2...l.=...n.E...o.J...p.W...q.]...r.i...s.z...t.....v.....w.....y.....z.....|.....}.........................................................................0.....I.....s.................\.......................U.......................c.......................~...........-...........P.................n...........Z.....o.....+.................P.....=.......................m...........g...........5...........).....J.................(.....U.....D.......................X.................'...........0.....p.........................................<.................Z...........4.....O...........`.................R.................7...........J.......................x...........C...........U...............................................3.......................p..........._...........`.................h...........,.....Y.....0...........6.....b.....T.....(...................................].........................................Y.....v.....J...........f.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-V8EBL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507710
                                              Entropy (8bit):5.366267790955764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E7EECD5B19E0FBE4A6D6FAFA81209C4C
                                              SHA1:46BC876FB95610EABD7F8A4734B45FBA629B76E2
                                              SHA-256:9EEEE70495C1D52F4260E86B23ACF8AEA21E68008A45A41BA0556AD48EADE2BE
                                              SHA-512:09E2AC627360DE3A8D5172E8E8BE084AEE07127CBA04D042213A9E9EEEA35011952DF49EAAB0F28DAE587ECA61D8CAC5EB7B197BDF96044265F52AB507D9D471
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....f.....t.................:...........Z.....|...........c.................K...........0.....L...........'.....{.................X.......................h.................C...................................L.....p...........N.......................w.................<.............................1.......................r.......................l.......................r.................".......................;.......................>.......................+.......................$.......................O...........3.....J.................>.....\.......................2.................8.....T..........._.................;.......................;...................................:.....Z...........X.................F.............................).....v.................>.....k.................k.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-VBQ8F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1133266
                                              Entropy (8bit):4.387039979900048
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29845370C202A7C1FAEC4BD65D2856E0
                                              SHA1:70078AFEB8488FCB670ED3199E7853CFBA4FD101
                                              SHA-256:57496D8C0159DFE74FEE320E1CDE18FC1A8854991B764BE085CACB1DE9AC6AB0
                                              SHA-512:E544B61B41DAAA16E8A519AAAF6C58A42B6F341BA5A9109F74154E7B40CC97FA7B7FE5C678EEEB7DB5E9DEBC5E7903C4073D677EBDDF7B32A5B75C3F96A08F16
                                              Malicious:false
                                              Preview:........K l.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y...........................................................Z.................P.....9.......................M.................h.....W.......................s.................d...............................................y...........?.................c.......................b.......................+.....o.................z...........T.............................`.......................r................................... .................L...........d...........{.................d.............................M...........Y.....!...........................................................O.......................J.....&...................................................... .....!....P!....r"....i#.....$....J$.....%....K&.....'....I'....w(.....)....o*.....*.....+.....,.....-.....-....#/.....0.....0.....1.....2.....2....[3.....3.....4.....5.....6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\is-VK41I.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507292
                                              Entropy (8bit):5.62887128025288
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6901EBBD0B49837B20FC11A3356F9C66
                                              SHA1:1D45310BA36C0247CC6493CF6E095B7F80030A02
                                              SHA-256:E55EA11EB9D59AA2F3FCD1818C5F325DF7EAFAB833AD624311F59228667D8F82
                                              SHA-512:E825802FA38BA2F3855F86AC297BD808A71D8902CF1680CAB20F9FBAF6691522FA834599F97621E18557B11662B0424D6329984417C0FD102E9870F78A34B105
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.........................................................................................b.................O.................-...........b.................N.................>.................Y.....d...........Y...............................................+.....|..................................._...........%.....8...........\.................J...........@.....a...........,.....R.....h...........5.....^.....p...........C.....j.....~.............................O.......................z...........7.....F.........../.....b.....s...........k.................H...........;.....S.................1.....F...........E.....|.................k.................0.................:.................'.....@...........D.....y.........................................B.................@.................!.................V.....f...........8.....S.....u...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\it.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471606
                                              Entropy (8bit):5.271836469512455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DDA6C80D323CF717B7D596292ED60628
                                              SHA1:22193A23952ECC7F37AA5DB98AC369B7E1AA7508
                                              SHA-256:622EBAC5319BE333D3415DE6571F79D48A23792B6E9DAEB4080B492EEC99D8DA
                                              SHA-512:741C817CFE404C96BDEAE902A6CE1BA77179742593202E3276F81473E7957A557C7AB40E5275469F41186F25D977F3811FC5714B9A7907776E91E929F879E8FA
                                              Malicious:false
                                              Preview:........E r.e.x...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.#...y.)...z.8...|.>...}.P.....X.....].....e.....m.....u.....|...........................................................q..........._.....{...........@.....................................................O.....x.................7.....E.........................................4.....^...........V.................@.......................a.......................~...........'.....@...........:.......................[.......................?.....i.....w................./.....:.................D.....V.................2.....=.............................`.......................9.......................B.......................n.......................=.....r.......................L.....x.................i.................K.......................&.....d.................2...............................................$...................................?.....U.........................................".

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ja.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):564410
                                              Entropy (8bit):5.833338590437962
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ABC924058F1AD7A374677AEAE49A12F8
                                              SHA1:948F5F2600A23F93F1D30A38408DEE80D7C5A5E2
                                              SHA-256:B33F0FCBD0B4A2BFE49E4607C0CF25B93B99A0AA4BF6A337E1EF6A7842748D3F
                                              SHA-512:C813567EC1776B20933912176EF0D4050F972ADC24B6EC9151C4E390EB696650773914F10502876B23ED5660547672810C6D4C64659DCB169706817BA4ECCBF1
                                              Malicious:false
                                              Preview:............e.6...h.B...i.M...j.V...k.g...l.p...m.x...o.....p.....q.....v.....w.....y.....z.....|.....}...........................................".....*.....1.....8.....?.....A.....F....._.....}.................Y...........7.....U...........K.................;.................9.......................F...........6.....g.....y...........G.....t...................................n...........2.....S...........3.....f.....v...........Q.......................r.................a...........c.....~...........B.....d...................................o...........7.....X.........................................`.....o...........k.................5.......................~...........J....._.........................................F.....h...........M.................%...................................X.................J.....l.....{.............................U.............................G.................\...........*.....K..........._.................E...................................b.....}.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\kn.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1085178
                                              Entropy (8bit):4.3593010164581925
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15A61AD50E2FB3833AC6A393A73F8488
                                              SHA1:6F603577883B716F792301F8FFFDEFDE3ACD8FED
                                              SHA-256:D08672BCEBAAE44591C08AA57C5B3511E0760027A39B6EC13F345F9DCB7C2BFB
                                              SHA-512:25E1473A54D9288C96BF64CDF7FCF5FC9E695A1A11A048143AAA83C3308AB215A1E0B362E257662B3D2D6E736C45A0E4BC8126A67E0D2274E0A9C8F236B62EC3
                                              Malicious:false
                                              Preview:........I n.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....}.....................................................G.................F.....G...................................^.....x.....R.................r...........O.......................,.................c.............................z.......................!.....'...................................K...................................t...................................e...........V...........;.....N...............................................Y.....-...........b...........9...........\...........`.............................>...........................................................G...........j.......................I.................0.........................................F.....v.....B...........! ....v!....2"....."....M#.....$....4&....2'....g'.....(.....).....*.....+....L,....1-.....-....$............/.....0....@0....s1....\2.....3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ko.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):477276
                                              Entropy (8bit):6.165762910369141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BDFB8A270C4B8786C8FC2B8A1CB60BAB
                                              SHA1:EC240169AED1CDC91030298C63824C053DE51205
                                              SHA-256:1CBB36AB058A27954F4BA1AF2778A4164FFA1719835C8A8E721722A3837233A7
                                              SHA-512:E22F7109C4DA972E4C138B36D30D3D589058E8418F260707D013A4A28F7D444B1C0213626DB1A8F2A3B9BB83467721493C26FB6C8A4D3305FC5CD9FCD1D42FE7
                                              Malicious:false
                                              Preview:..........1.e.....h.....i.....j."...k./...l.7...m.?...o.E...p.L...q.R...r.^...s.o...t.x...y.....z.....|.....}...............................................................................!.....4.....D...........8.......................x.................B.......................s.................0.................#.....3.................&.....9.................).....D...........".....W.....k...........&.....T.....a.................D.....Q...........#.....[.....k...........n.................7.............................e.......................@.....e.....u...........Y.......................w.................%.......................,.......................).......................G.......................z.......................j.......................u...................................3.....c.........................................................................................X.....f...........?.....p.................O.....~.................D.....d.....w...........9.....h.....{.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\lt.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507620
                                              Entropy (8bit):5.627043956013093
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37274D5FBCD7DFD0778ABFA2F95AC435
                                              SHA1:603B198724776B3284D202E4042EB24ABDAC3CC4
                                              SHA-256:5078AF2EF4D000CD3D8E886B907B2BA279D71477D7012FE3E54629CA3898E0A9
                                              SHA-512:962C8B533D2FBC2E6C668CB7FAA158170D534D35F2727861E27B360F25B7E83DC071B4460C93743BB1A5BB1E38CBEB975A97DC62EBA13E5861200FD1F77874CD
                                              Malicious:false
                                              Preview:........: }.e.b...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................N...........<.....W...........m.................g...........A.....[...........R.........................................[.............................(.....\...................................l.................-.................U.....e...........}.................n...........L.....j...........L.....s.................q.................&......................._.................0...........$.....^.....m...........k.................7.......................m.................)...........\.................@...................................K.....s...........e.................E.................5.......................A...........h.................[...........".....F.............................~...........@.....`.............................B.......................b...........2.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\lv.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507292
                                              Entropy (8bit):5.62887128025288
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6901EBBD0B49837B20FC11A3356F9C66
                                              SHA1:1D45310BA36C0247CC6493CF6E095B7F80030A02
                                              SHA-256:E55EA11EB9D59AA2F3FCD1818C5F325DF7EAFAB833AD624311F59228667D8F82
                                              SHA-512:E825802FA38BA2F3855F86AC297BD808A71D8902CF1680CAB20F9FBAF6691522FA834599F97621E18557B11662B0424D6329984417C0FD102E9870F78A34B105
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.........................................................................................b.................O.................-...........b.................N.................>.................Y.....d...........Y...............................................+.....|..................................._...........%.....8...........\.................J...........@.....a...........,.....R.....h...........5.....^.....p...........C.....j.....~.............................O.......................z...........7.....F.........../.....b.....s...........k.................H...........;.....S.................1.....F...........E.....|.................k.................0.................:.................'.....@...........D.....y.........................................B.................@.................!.................V.....f...........8.....S.....u...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ml.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1133266
                                              Entropy (8bit):4.387039979900048
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29845370C202A7C1FAEC4BD65D2856E0
                                              SHA1:70078AFEB8488FCB670ED3199E7853CFBA4FD101
                                              SHA-256:57496D8C0159DFE74FEE320E1CDE18FC1A8854991B764BE085CACB1DE9AC6AB0
                                              SHA-512:E544B61B41DAAA16E8A519AAAF6C58A42B6F341BA5A9109F74154E7B40CC97FA7B7FE5C678EEEB7DB5E9DEBC5E7903C4073D677EBDDF7B32A5B75C3F96A08F16
                                              Malicious:false
                                              Preview:........K l.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y...........................................................Z.................P.....9.......................M.................h.....W.......................s.................d...............................................y...........?.................c.......................b.......................+.....o.................z...........T.............................`.......................r................................... .................L...........d...........{.................d.............................M...........Y.....!...........................................................O.......................J.....&...................................................... .....!....P!....r"....i#.....$....J$.....%....K&.....'....I'....w(.....)....o*.....*.....+.....,.....-.....-....#/.....0.....0.....1.....2.....2....[3.....3.....4.....5.....6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\mr.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):934541
                                              Entropy (8bit):4.4365640897236505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EAB367E9F45366FF6182DE9C989F0EAC
                                              SHA1:EDAE15CE3933672F25B73730B5E1FD9871F2B262
                                              SHA-256:208B8DE31DA311B8C720284A46D045DB952740293A2C01E2C3CFFC6A97CDA7A5
                                              SHA-512:61219D0B26D039F6996A8433B260FF059858CF872A28A462A6948F99B88FF288FDBEDD1E2523DA341E244C91FDD9FF4C80C72C202D746CFD2ABD59D202602F11
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................".....).....*.....+.....0.....R.....t.................7.....o.....-.....i.................\.................%...........L.....R.....O...................................8.................8.....X.....b.....@.................z...........................................................u...................................d...........q.................{...............................................\...................................:....."...........a...........T...........u...........X...........q...........d.............................!..........."...................................H.....~...........l.....2...........................................................W.................. ....R .....!....a".....#....G#.....$.....%.....&.....'...._(....i).....*....w*.....+....^,.....,.....-.....-................&/....G0....;1.....1

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ms.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):440491
                                              Entropy (8bit):5.26850729829571
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:47C581BA86F8E8ED064C6F2C2528E39C
                                              SHA1:F5F78898490A2A355BBAE157EAB716B29F755C81
                                              SHA-256:57F48C9B4DFCD9406909230689C9C0028704DF2D708F9CC30E92CEAB244C6E39
                                              SHA-512:DE989540872F75022E9963BDCDBCED7CFB393FD5CE5F860A546AB946A00F9253500032B3A8F214768829829C0CA666A3BC967A39331D00BB9B10393EE3BCCFEA
                                              Malicious:false
                                              Preview:........T c.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.+...w.8...y.>...z.M...|.S...}.e.....m.....r.....z.........................................................................................[.....w...........6.....j.....z...........X.........................................9......................./.......................1.......................W.................(.....x.......................U.......................C.......................`...........-.....?.............................I.............................o.......................i.......................q.......................g.......................U.......................H.....{.................i.......................j.......................J.....n.................'.....P.....a.................E.....h.............................}...................................#.....<...........3.......................d.......................q.......................A.....c.....s...........!.....N.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\nb.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):431086
                                              Entropy (8bit):5.412510838847386
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:206FECEE346302A44737681661A419D4
                                              SHA1:0CBB4EDD9CB8EF23746242D16717D2042C3254D0
                                              SHA-256:2D7103F4B60C185F0EFEA040D23F5040C8EE405F6E02DA2B38C894AFC29E0832
                                              SHA-512:C4A8C92F98F6A3D5792DC3CA50BC4552060979FEB269BFA18422B68787505361864CE548D420AED0BF600EEDB64B1EC96860D3DC962AD5F910A52F6E3A2CDFA0
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................T...........G.....\...........%.....^.....q.............................Q.......................R.......................@.......................A.......................m.................5...........B.........................................X.................7...........W.......................b.....{.................7.....\.....l.................?.....O.................N.....b...........".....P.....`...........(.....Z.....j.................F.....V.................B.....P...........:.......................H.....n.................,.....K.....d.................3.....E...........2.....q.................\.......................h.......................o.................,.......................y...........?.....h...........0.....\.....o.................(.....6................./.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\nl.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):443233
                                              Entropy (8bit):5.354406946962274
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9FF1D4EB5F94297FDB8619004C0CACF8
                                              SHA1:FE149C387C18D5B2F63A30C49019E7FD8AB913AB
                                              SHA-256:6DA873B61E1DD29ADE307EB1ACF1834728CFEF98CC701A475CD360E493380380
                                              SHA-512:89BC1FACD343FD35BF1C10994422826E97291634C9DFF45CE55F7BF620261DED041F9F8FF3AADE4DA082B915212594F45C99133BC20274C660DBD6B1FB7894B4
                                              Malicious:false
                                              Preview:........0 ..e.N...h.Z...i.k...j.w...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.&...........3.....;.....C.....K.....R.....Y.....`.....a.....b.....d.....p.......................1.........................................0.................\.....r...........?.....u.................7.....`.....o.................C.....Q...........).....`.................Y.......................n.......................}.................;...................................C.....\.......................3.............................U.......................D.......................F.......................+.....~.......................].......................R.......................q.................*.............................f.......................T.....|.................`.......................e.......................[.......................p.................V...........,.....=...........+.....m.................].......................F.....j.....z...........<.....j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\pl.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491896
                                              Entropy (8bit):5.733819464813427
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3AC2084834A61A90B33F64537E3B1F27
                                              SHA1:72DB3F2DAF8EE32CF224D9CF905C2D6E828C2D71
                                              SHA-256:791D2F53FA305B4929A76DEAD75FAFFDC367B5C4CA79CEBBAD71D79FEC0031E2
                                              SHA-512:BDF19FD085035916FC745D00BF9DAEA34D703BC2C6F669D21E39AAD5C8AD05500088878EBBD2B86B80696E93EBF7DE3143DB078B25A98251CA2C8525F6E88141
                                              Malicious:false
                                              Preview:........Q f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{...........................................................................................................o.................N.................6.................:.....P.................1.....E.................D.....V...........-.....c...................................\.......................r...................................b.....~.............................k.......................+.....w.......................=.....^.....l...........5.....n.................=.....p.................7.....h.....x...........#.....O....._.................O.....`...........J.......................I.....f.....}...........&.....G.....m.................].....r...........D.......................].....{.................E.....k.................d.................F................. .................Y.................>.....k.....|.................+.....:.................P.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\pt-BR.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):463221
                                              Entropy (8bit):5.420005926145208
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B90235085171D3331791C016D3C9B22
                                              SHA1:8342C7C34EE6824D6E124ED16F6F9CE93B1AA8C5
                                              SHA-256:F5D1F8357CB40F5C8E3B84C2FADE5B41636A931D4B047122489BD0443A43E1E7
                                              SHA-512:264186B540D55629C4CC44AF4FC4D0F1F096F575250FC16FC6621299842367DB424595FBA4F0CCE63812ECEE563966D100AD7B7D0C7346BB60C2159E09FFE4B4
                                              Malicious:false
                                              Preview:........H o.e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...|.D...}.V.....^.....c.....k.....s.....{.................................................................~...........f.................I.................%...................................-.....B.......................".....x...................................T.................y.................T.......................y.................*.................e.....~.............................O......................./.......................-.......................0.......................3.............................i.......................C.....q.....{...........8.....p.................|.................:.............................U.....{...........,.....W.....o...........h.................L.....q.................R.......................m.................W...........+.....A...........B.......................i.......................A.....g.....|...........T.................".

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\pt-PT.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):466574
                                              Entropy (8bit):5.393834079901674
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:072E2BF5C2C23C26A342B1CD5090ADB0
                                              SHA1:F60997D94FDF3A2A3892722750E8533B7D68CC59
                                              SHA-256:ED87A5C64BF2C5D57A2DD7B71C8A338E0A5402AD7B6EE731773601E885FD01CF
                                              SHA-512:DF8B3407AA31D3E46218D2E277359E32BF3C6623A54CD2400743BE6432210FCCBA82E92EBDBCA0F44F322A4E7BA7FF4522E779816E992BF40C08E426BDE498D5
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................n.................T.................=.................8...........#.....g.......................X.....h.................<.....N...........<.....~...........".......................\................. .....{................./.................M.....b...........X.................-.............................r.......................u................. .......................(.............................i.......................B.....o.....y...........0.....d.....u...........S.......................c.......................(.....B.....S.................D.....^...........7.......................M.....w.................7.....m.................C.................1.................$.................[.................b.......................V.....{.................^.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ro.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481152
                                              Entropy (8bit):5.445989518263063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72F4A085F0FF9435A99E52CE890710ED
                                              SHA1:D5AC32EB03273B8463D42EFA97712DBE9732B28B
                                              SHA-256:74589FEA8304CB7DA427AB5E5DC71E18F3B1096A0C62B5569B539A08BADF6D6E
                                              SHA-512:29BB40648A59277F35F5AEBD321D6F5C2666756A821F67ACE74EBD222BC3B2A0F4CD2B138C0CEF008AD76D6019095F54D61C9B30AB4ACF64F3ED508B13FB3A03
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....}.......................;.................3.................-.....A...........H.................9.......................Y.......................<.......................K...................................F.....j...........H.......................l.................'.......................x...........H.....v.................3.....P.............................p.......................U.......................R.......................?.............................e.......................M.....|...................................G............................._.......................d.................1.......................n......................._........................................./...........,.................!.......................n.......................r.......................t...........3.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ru.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765340
                                              Entropy (8bit):4.963754533847095
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F7AF63DF54FD846C16B3C97E588FD3F
                                              SHA1:7622045E2EA5D5A690A814873AC17B3CE57E6035
                                              SHA-256:EC13F5B2DAE5F7577F482762A47D2120AE318AFB2D35A073D809F740F6937BFC
                                              SHA-512:EB0B6C23A4A28049FC0E9F8AEB3639AEB36CE6A0AFAE570680FC9EB7752F8571AC8F06E92EFCC325311CE4BB0C4DE7E54C2F2CBB7109F451D67EAF0179F187BD
                                              Malicious:false
                                              Preview:............e.T...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j...................................d.......................F.......................w...........'...........5.....z...........c...........k.................@.................O...........A.....}.....p.....3.......................@.................n...........O.....t.....,...........V.......................".....P...........c.................Q...................................0.....M...........R.................V...........0.....U...........X.................2.......................u.................4.....F.......................G.........................................$...........?.......................a...........*.................9.....K...........z.......................2.......................U.............................N...........L.................'........... .....Y.....r.....J...........g.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\sk.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491754
                                              Entropy (8bit):5.793671440598259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:56F9681FE00C2C813332B540349B8C26
                                              SHA1:838EA31D9C62413ED2F9A1001A9DE6CDFD629585
                                              SHA-256:5C6239569CF39699A77AEC0D6E418EABCB1E4A5B1C504676B9C9729B59214480
                                              SHA-512:2D204D9C166CDA23E9994EAF5593B017CC8E2337F6D5F9BAAB86548F04CCEE04C12E85E15149C8B1F99A071CDAC0AF1F20DF1D9F0BB91595B93C45CD7D99123E
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...|.;...}.M.....U.....Z.....b.....j.....r.....y...........................................................~.....#.................'.......................q...........E....._...........0.....i.................O.....~.................J.....s.................`.................U...........!.....D...........;.....v.................r.................E.............................;.......................].....}.................S.....y.................L.....s.................e.................#.......................8.......................I.......................h.................)...........C.......................F.....a.....u...........*.....F.....[...........%.....].....m...........j.................?.......................C.......................c.................*...........e.................`.................).................).....=.......................".................[.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\sl.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):475865
                                              Entropy (8bit):5.477217061104823
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48D1A0F19DA57879F019D8B158574D97
                                              SHA1:F642DFCF4FA4EC008EDFE6A170350C0FCC7321D2
                                              SHA-256:7378E9E25C132B86D049D94A8284229F164CC3AD8C8E2426262172EB63C09BB3
                                              SHA-512:4061FB292F090108D7CF2DC05279A602E08D6F1DA3A85B5738BDE48AFB59F32BEC1D1871083E647FDE1881C04E3C0480EE372EFD62D89A8EE2B4A5169D21BFBC
                                              Malicious:false
                                              Preview:........* ..e.B...h.N...i._...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....h.....v.................+.................&.................-.....>...........J.........................................#.............................r.................'.......................g.................3.................K.....a...........5.....l.................z.................k...........<.....b.................(.....@.......................%.........................................<.....P.................J.....[...........A.......................S.......................W.......................s.................*.............................d......................._.................0.......................a.......................Z.......................z.................,...........v.......................6.................5.......................1.......................#.............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\sr.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):717149
                                              Entropy (8bit):4.90268618853934
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CEB5A570B85F1E7A385D7D3BBDC71A04
                                              SHA1:943B103639DD738DC17365DF90EF0B27BE35A728
                                              SHA-256:9BD132621993B3F2FE15A4BB8DA7A791A75CD340A0A819FFC2258E1384F2A58D
                                              SHA-512:0CC08A9FFA0940DEC5A740012997BD1D5C1F38A2106C125D63B8F7F4608EF1E6E7EA5926ADB49C0316D34CFCC9E80E5E6DC189740A93E0DC6DC77988959CA12A
                                              Malicious:false
                                              Preview:........J m.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...|.H...}.Z.....b.....g.....o.....w.................................................................?.....,...........m...........e...........r.................[...........#.......................I...........x.................w...........4.....K.......................G.....G.............................-.................v...........o...........z.....1.............................i...........6...................................>.....a...........^.................y...........z...........I.................?...........X.................Z.................>...........m.......................[.............................=.....e...........t.......................&.....s...........`...........S...........F.............................f.......................G.............................K.....i.....W...........p...........t...........S.....t...........o.......................=.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\sv.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):432643
                                              Entropy (8bit):5.520056060273409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37BFD002B9A56B236A07B4BFECB6ACD
                                              SHA1:EB7687D66DC7195AEA46CCD52FFEB123B081E3BD
                                              SHA-256:3634CC48474C78ECA269AEBEA00CCE47CEDAEB2C1A522A30EEF3ED0013926923
                                              SHA-512:5D042CC92123F0389012C9618F6EDA666A97DA0FE83EBEF883BD2C032C1E937B9EA0E1F6C4BB5B0CED7E28F6C7BEBD2D9E73D077604DD66F8B1B280DA27A0A73
                                              Malicious:false
                                              Preview:......... ..e.....h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....A.....S.....g.....{.............................G...................................P.....i...........9.....r.................D.....s.................C.....t.................h.................:.......................m.......................w...........&.....6...........2.....}.............................;.............................h.......................E.......................9.......................F.......................;.......................+.......................".......................-.......................B.............................k.......................<.....].....o...........G.......................h.......................Y.......................O.....................................................7.....]...........).....Y.....l.................$.....2...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\sw.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):454700
                                              Entropy (8bit):5.349003712537203
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0CEEBA9BC94F6430729C85AD9106926
                                              SHA1:8A268A2EA070E4D5BE6B0C19C41E01EEC4BA0D72
                                              SHA-256:53EDF339033BB99EA23BE682C15ECEBE6D78C4F8B64669E74B7008FB076DC678
                                              SHA-512:121536514ADEFAAF15E5232A4F70A4787EC428E123FAC9DAD5C6EDF5C2FFC5A112C1936D1FAE3C954AB11BBF52BB043C1B3AD5CE135886279CE69D5C05254F40
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.............................A.................&.................4.....F...........9.......................R.......................C.....n.....}...........(.....W.....e...........2.....f...................................a.......................o.......................p.............................,.......................L.....t.......................@.....I.........................................C.....Q.................6.....H.................I.....T.................+.....8.................+.....4.................^.....w...........*.....V.....r...........4.....e.................F.......................n.................D.............................l.................-.......................l...........A.....U...........7.....z........... .......................R.......................t...........'.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ta.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1128054
                                              Entropy (8bit):4.173066636042835
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FB43B1980819D75556A4C8C32FB4BD95
                                              SHA1:B6F81B27E147EC1BCB2E0D3BC1344115C7BECDDC
                                              SHA-256:8E7F08307C90BF61616888A57C05D7E1E6B0182D01F7ECA895AD79B2C00F337C
                                              SHA-512:DFDBE66644B31D6801F0C3C11739FB498D71B3B7CE40919A1277155A45181C0E251E9E3FFB84FDE225F801A52ECD0F245DF050612862A2B24B5DEA939FB31EE4
                                              Malicious:false
                                              Preview:........ ..e.....h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....u.................D...........?.............................j...........2...........d................./.............................Y...........t.....V....................... .................w...............................................E.....m...........A...............................................".....%...........B...........w.....S...................................C.....n.....x...........V.....M.....>.............................=.....k.....d.....T.............................d.................D..... .....d....._.....G...................................P.....% .....!.....!....&"....O#....]$.....$....e%....=&.....'....S'.....'.....(.....)....e*.....*....5,....H-....).....z.....f0....P2.....3.....3....N5....[6.....7.....7.....8.... :.....:....1;....5<...."=.....=.....=.....?....C@.....@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\te.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1043527
                                              Entropy (8bit):4.426337953995401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6B594588A6292B3D13269C23EA35231
                                              SHA1:3D098299EB245B24E49C3FCC178AE1D09985E265
                                              SHA-256:70A466AD6291A12F75347F552C15650A040D26EB415E04018D5DB25F0CEE398D
                                              SHA-512:2077492F072D0F384A3D9FD6963ECBDDC7A5A680283EBF965ACB888A47E1B4E90312A075A869F9BE51AF9760D4AABC6A5FB266D5F7252F998C35C3AD5211D87D
                                              Malicious:false
                                              Preview:........X _.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}...............................................................................+.....h...........Z......................./.....!.............................v.................%.........................................!...........i.............................Q.......................>.....t.....h...........?.....{.....r...........E...............................................7....."...........'.....\...........J.............................:.....{.................F.......................(.....o...........`.................7...........}.......................2.....v.................b.................W.......................Y.......................@...... ....9 .....!.....".... #.....#.....$....r%.....%.....&....Z'....8(.....(.....)....T*.....+.....+.....+.....-....P/.....0.....0....D2....U3.....4.....4.....5.....6....O7.....7.....8....n9.....9.....:....p;....k<.....=

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\th.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):883611
                                              Entropy (8bit):4.488277211018212
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1D7AE2CC0781852DF5AC948E761889B
                                              SHA1:9FF5B70558C26FF0C4A0A234DF662A9B5B00D11B
                                              SHA-256:1DF078BCD2D0FA247B1031A88CE2EFF27BACE693F8B85617D22E13E8DA21B73C
                                              SHA-512:825D13E218FF433C478188A4ACC90F84DD0D216A3F08A389091CD2DB3B2528B26BD75B143BB9F23BF02E21ADA7229093F85BF4ACF2A573F6DC8C8796521D6897
                                              Malicious:false
                                              Preview:..........!.e.....h.&...i.....j.9...k.H...l.N...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....|.....}.......................................................!.....(.....*...../.....S.....}.................3.............................X.............................`.......................U...........H.................6...........R...................................z.....q.............................J.......................^.......................l.................>.....-...........+.......................0.......................8...............................................9.................,.....P.................=.....d.......................'.......................D.....^.....[...........G...................................B.................`...........G.....w...........L...........R...........g.......................4.......................C.............................................................................@.....p.....&.................8.....A .....!.....!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\tr.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):462528
                                              Entropy (8bit):5.606577668939973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B678783C319BCB892F839440A469130C
                                              SHA1:889D5379B23D8CBCA08968E469242E73725025BB
                                              SHA-256:045A38565C995C9B1F428295392F77052171BF4B1E7B327B921061C2BA7259FD
                                              SHA-512:18E8AFA27EFD25F87421A2CB5E9F34983D932AC61BABB171930BFBDA1186EC55BEEBDF110CA5BFBCADEC53D3EC41AF157E4FB7A2ECBE3B807AF1F12DD52355C3
                                              Malicious:false
                                              Preview:........^ Y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.......................................................................................................>.........................................W.................-.................).....<.............................{.........................................4...........'.....j.................L.....~.................C.....m.....}...........i.................C.......................{.......................{.......................x.......................x.................!.................'.....8.................+.....8.................$.....0.................).....6...........;.......................h.......................[.....}.................B.....z.................c.......................l......................._.......................s.................z.......................4...................................`.....|...........@.....p.................^.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\uk.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):763471
                                              Entropy (8bit):4.999444806602008
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D03AD4371302B7FB9453E56E95D8781
                                              SHA1:4AD2A331D6F7D2D82D0F54328CF9A29F5CF8154E
                                              SHA-256:1395F97A60BCF82321118878292533103DEB43EE4823D6F7114F3F0D405EEC0A
                                              SHA-512:FCC24303E43039860EADD9D65BB790395AE706CF28358241D91BFE7E6C62E87F8A70E0069183208CB3681412D5AE8245891605CEE93C0DCDDDD91367168890CD
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.#...k.2...l.=...n.E...o.J...p.W...q.]...r.i...s.z...t.....v.....w.....y.....z.....|.....}.........................................................................0.....I.....s.................\.......................U.......................c.......................~...........-...........P.................n...........Z.....o.....+.................P.....=.......................m...........g...........5...........).....J.................(.....U.....D.......................X.................'...........0.....p.........................................<.................Z...........4.....O...........`.................R.................7...........J.......................x...........C...........U...............................................3.......................p..........._...........`.................h...........,.....Y.....0...........6.....b.....T.....(...................................].........................................Y.....v.....J...........f.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\ur.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673161
                                              Entropy (8bit):5.277859283772137
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:93DB2C0625CC25A0160268DF1E8D7DB0
                                              SHA1:63460D6C4A93F8DBF55A768F82B61A202186198C
                                              SHA-256:AD15FB814C172D8526DF00B7B130435F3B14581116F9FDD6368593E6AA2D128F
                                              SHA-512:C258819E2E84F771533E66BB3F82BBF68E23E0FDB1CEF7DC655E058DA6ED5612331AAED8BBEF55AB1E37D135BB8D754F1F9BE4E6687695D21C20662254FCAAEB
                                              Malicious:false
                                              Preview:........; |.e.d...h.p...i.x...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t...................................~.....................................................9.....n.....!...........(.....L...........W.................Z...........&.....I...........U.......................(.................l...........\.....{.....#.................<.................I.....u.....S.......................N................. .................H.....j...........S.................K.................=...........\.................^...........%.....A...........=.................(.........................................*...........:.................0.......................y...........9.....Z.....!.................\...........].................i...........D.....j.....<...........6.....g.....7...........n...........v.....#.......................C.................m...........).....V...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\vi.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):542659
                                              Entropy (8bit):5.812552118931453
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B6AC1037F684BD0F61BBA25D03DD493
                                              SHA1:44AAE042D51BC1F726A56911BC71D9862E640062
                                              SHA-256:502E1846C3CC6CE0484AF890F92F69CDFBF0F5A98B8211CD551C03FF858A1A0F
                                              SHA-512:BC290D62E563883ED04CA4F4F5709DD1ABAF139D11A54FE5E3E44DA807C194B85778795058A474C87166FC0442C9B2F1FE22DA20353CD764A46AD850B9BF9E55
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....|.....}......................................................................... .....1.....Z.....y.....1...........O.....k...................................$.................9.......................t.......................i.............................:.................w.......................C........... .....2...........1.....}...........9.................F.......................&.................!.....@........... .....J.....[...........;.....w...................................P.......................e.......................z...................................=.....O.........................................I.....h...........=.....g...........^.................]...........Y...........#.......................q.................>...........8.................W...........m...........F...........D.....~...........g................. .......................m...........U.....v.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\zh-CN.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):400903
                                              Entropy (8bit):6.739635196638547
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2846F59BD7FC670307E900172A74272D
                                              SHA1:9AFD950370B9FDC4831C72864348B8FFAE36B6D3
                                              SHA-256:A1ABC5A22BAC57253082C9BC15645EFEEFE60B4F0A82ECBFD316D620DA49FE89
                                              SHA-512:F38C107FD60DE563A09EBD9A71D6F96F14102DF467C58E51560C274BF426EBB6D5D3EDE6955AFE5DAD17DFDF1227368AB964AC326559DDE5C1991F787C0853C0
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....|. ...}.2.....:.....B.....M.....U.....d.....i.....q.....x...............................................<.......................m.......................k.......................v.................,.....z.......................R.......................1.......................1.......................M.......................>.......................$.....|.................+.............................q.......................8.....^.....j.......................,.................4.....F....................... .....y.......................^.......................6.......................9.......................J.......................!.....o.......................b.......................E.....y.................(.....B.....N.................0.....B.................9.....Y...........B.......................h.......................e.......................-.....K.....[.................;.....M.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\locales\zh-TW.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):397474
                                              Entropy (8bit):6.746352572041569
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D91E515657D4A3AC135214B6152BDED5
                                              SHA1:26EF564AB9326BDE96C038B769F110F80BB01BA0
                                              SHA-256:4126E6EE9F924F86046ED00C410B37543545EFB4D0E99E4FA472987D108B4CFE
                                              SHA-512:7B3A361C1ECC11A36EA9D92C4FE1DB85F3F53B1656B145289224A85270535E35A3E3E791D23D331A2DD09EBE18ED190A16FF230B56A8CC327E090F69EC6CBB11
                                              Malicious:false
                                              Preview:............e.^...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....M.....T.....[.....].....b.....k.....w.........................................(.....}.......................r.......................f.......................M.....v.......................?.....L.................".....<.................(.....=.......................+.....~.......................m...................................+.....=.............................;.............................R.....u.................,.....U.....a.................2.....>.................!.....-.............................W.......................H.......................>.............................J.....d.................H.....Z.................8.....[.............................\.......................G.......................P................. .................'.....<.......................'.....g.......................!.....t.......................f.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\master_preferences

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):8917
                                              Entropy (8bit):4.704075078569433
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BC76C3E23FE0F28A7679A9D454EA91D9
                                              SHA1:7DA58E8E55B91BFCAF21607335CBF13DC892FE3E
                                              SHA-256:1576CBEA2FDAEA2C444C11D5FB816F86C7D00A2E9A0C821B3FBDD676C9D28C84
                                              SHA-512:F7D39412EE5F3CAA40AEE76CA89C137A9F2C25517F644E41C9DAB24EADC8B50526AF612BD8E7E69DCDDBDF5AE4E75BECC7AB5EB91444050ABFFF5C6EBB855ED7
                                              Malicious:false
                                              Preview:{.. "homepage": "chrome://newtab/",.. "browser": {.. "check_default_browser": false.. },.. "distribution": {.. "skip_first_run_ui": true,.. "welcome_page_on_os_upgrade_enabled": false,.. "suppress_first_run_bubble": true,.. "suppress_first_run_default_browser_prompt": true,.. "do_not_create_desktop_shortcut": true,.. "do_not_create_quick_launch_shortcut": true,.. "make_chrome_default": false,.. "make_chrome_default_for_user": false,.. "import_autofill_form_data": false,.. "import_bookmarks": true,.. "import_history": true,.. "import_saved_passwords": false,.. "import_home_page": false,.. "import_search_engine": false.. },.. "sync_promo": {.. "show_on_first_run_allowed": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\master_preferences.tmpl (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):4971
                                              Entropy (8bit):4.688630860344496
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AE97F42BA3F28093353A1A8DE8D433D7
                                              SHA1:948F5A4A3EA43F95A42D4406F4BC6C987F6CD263
                                              SHA-256:7814CFF2B40FAA7CFF62F304EB3D5554A943E57A4DE2EA3C808C8622166A9F0A
                                              SHA-512:093D0759BAE618FC58A53254D2059432B0FB39149FEB5AC614DA84D6A21ED513972A213B8F799EAB903E8EA6B762E9174C125C7CF5CB0A310F1076CD6FD17B30
                                              Malicious:false
                                              Preview:{.. "homepage": "chrome://newtab/",.. "browser": {.. "check_default_browser": false.. },.. "distribution": {.. "skip_first_run_ui": true,.. "welcome_page_on_os_upgrade_enabled": false,.. "suppress_first_run_bubble": true,.. "suppress_first_run_default_browser_prompt": true,.. "do_not_create_desktop_shortcut": true,.. "do_not_create_quick_launch_shortcut": true,.. "make_chrome_default": false,.. "make_chrome_default_for_user": false,.. "import_autofill_form_data": false,.. "import_bookmarks": true,.. "import_history": true,.. "import_saved_passwords": false,.. "import_home_page": false,.. "import_search_engine": false.. },.. "sync_promo": {.. "show_on_first_run_allowed": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\notification_helper.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1257472
                                              Entropy (8bit):6.459845894027243
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4C20C7112B6E8BF10D7DF44D97840C5
                                              SHA1:17FFBE2E4CA78C8ECE222D0CD84D795F1CD5E1BB
                                              SHA-256:64C045C166D59F16DA04DB35B6FA4E4418C4B1A36379020D38D72F7CB7F86E31
                                              SHA-512:8DDFEBE870EA20754D36FFF6496BE798FDF5A11237416429494AE0A55D5F6ED527895D111C3F066FA2809D94E4E615F9EE878221567C1327E243C948A831DCDA
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..................<.........@.............................`............`.........................................p...\...........0..(.... ...............@......L.......................0...(.......@..............0............................text...v........................... ..`.rdata..............................@..@.data........`.......H..............@....pdata....... .......F..............@..@.00cfg..0...........................@..@.gxfg...@-..........................@..@.retplne.................................tls................................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...(....0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\resources.pak (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8178684
                                              Entropy (8bit):7.996793493800157
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:3E2E5EBB90FDD6540201009176A9BBFD
                                              SHA1:18AAF387D73A0CBE889C15FDCBD403DE18BE17CD
                                              SHA-256:B9C6C00F6D20A9F93EEF7341A1D036BAC8BB46501CC829AC12DD8787150DD488
                                              SHA-512:15FDF41B9D9A60D1D5377B57F4B0BBE782BD85828316E001C5CA06BADB0D23374E0FCD27294BF263DB31D8BED30A29C8250C03383C3385869279B56EDAC1DC84
                                              Malicious:false
                                              Preview:............f..:..{.PE..|.$H..~..K....3^.....`....R.....d.............................0.....W...........O5.....8....=:....f;....GD....]E.....G....+H.....I....AJ....vM.....s....mt.....{..........e......................2.........2;...7;....8;....E;....F;^...G;....H;....I;J(..J;.7..K;pG..L;.V..M;.e..N;.y..O;....P;....Q;....R;....S;A...T;#...U;....V;L#..W;.9..X;.S..Y;.i..Z;....[;....\;M...];....^;...._;.....<.....<.....<.....<4....<c....<.....<.....<.....<.....<.$...<$+...<,/..(=./..)=.3..*=.5..1= :..2=.C..3=}R..:=9s..>=.t..?=.y..^= ..._=U...`=....a=....b="...c=....d=.....=.....=Q....=E....=.....=.....=#....=.....=1....=.....=.....=.....=.....=.....=.....=.....=.....=.....=j....=.....=M....=.....=.....=g....=.....=.....=.....=.....=.....=+....=<....=r ..&>HH..'>.I..(>.J..)>wO..*>.V..+>7X..,>.Y..->j[..:>.a..;>.d..<>.g...@lm...@.o...@.q...@.r...@.u...@.x...@ty...@(|...@'}..BEP...CEl...DEl...EE....FE...GE0...HE....IE....VEF...{E....|E....}E...~E.....E.....ES....EK....EI....EH....EV....E..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\resources\inspector_overlay\inspector_overlay_resources.grd (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text
                                              Category:dropped
                                              Size (bytes):532
                                              Entropy (8bit):4.912769861588248
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E6229A8D1ECC4D9D6B49DC2986624285
                                              SHA1:0CAA0BDF14BE3C3E74ABEBA57D31A3DD0D58EB5E
                                              SHA-256:68760FC7002C3999D3B2AC6EB80FEBE28182134A0DD1D53829F660B3D96BC9EF
                                              SHA-512:764C3636877086DC5D30A7539AB01CD2D87979B5E0E34B5216F99F63BCF5B9AC216631525BD2A960F063F325820262D616053E36A8FFDD3BE67543B5D33963B0
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?>.<grit latest_public_release="0" current_release="1" output_all_resource_defines="false">. <outputs>. <output filename="grit/inspector_overlay_resources_map.h" type="rc_header">. <emit emit_type="prepend"></emit>. </output>. <output filename="inspector_overlay_resources.pak" type="data_package" />. </outputs>. <release seq="1">. <includes>. <include name="IDR_INSPECT_TOOL_MAIN_JS" file="main.js" type="BINDATA" compress="gzip"/>. </includes>. </release>.</grit>.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\resources\inspector_overlay\is-K8Q9D.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
                                              Category:dropped
                                              Size (bytes):79113
                                              Entropy (8bit):5.556792880818279
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:893A2B9EDC9C85781D6FD211D52AB83D
                                              SHA1:A413A94C401BBE3634F92163D2806EE197F770AB
                                              SHA-256:6853E8DD17008B5E03DAD3F6D464EAA92BAF969345E305AFAE6FF3C3355BE93E
                                              SHA-512:1861B0D819F82EB4E45A62E9A72A0316D52E5B3AAFD5D9854F10D76E36E145E50AC9E1D2A38A091E9C4B0B44D4DA2B4717B2E1640D90552719F1E80ECB34CB9E
                                              Malicious:false
                                              Preview:!function(){"use strict";const t=new CSSStyleSheet;t.replaceSync('/*\n * Copyright 2019 The Chromium Authors. All rights reserved.\n * Use of this source code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\nbody {\n margin: 0;\n padding: 0;\n font-size: 13px;\n color: #222;\n}\n\nbody.platform-linux {\n font-family: Roboto, Ubuntu, Arial, sans-serif;\n}\n\nbody.platform-mac {\n color: rgb(48 57 66);\n font-family: ".SFNSDisplay-Regular", "Helvetica Neue", "Lucida Grande", sans-serif;\n}\n\nbody.platform-windows {\n font-family: "Segoe UI", Tahoma, sans-serif;\n}\n\n.fill {\n position: absolute;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n}\n\n#canvas {\n pointer-events: none;\n}\n\n.hidden {\n display: none !important; /* stylelint-disable-line declaration-no-important */\n}\n');class n{viewportSize={width:800,height:600};viewportSizeForMediaQueries;deviceScaleFactor=1;emulationScaleFactor=1;pageScaleFactor=1;pageZoomFactor=1;scro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\resources\inspector_overlay\is-M57D6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text
                                              Category:dropped
                                              Size (bytes):532
                                              Entropy (8bit):4.912769861588248
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E6229A8D1ECC4D9D6B49DC2986624285
                                              SHA1:0CAA0BDF14BE3C3E74ABEBA57D31A3DD0D58EB5E
                                              SHA-256:68760FC7002C3999D3B2AC6EB80FEBE28182134A0DD1D53829F660B3D96BC9EF
                                              SHA-512:764C3636877086DC5D30A7539AB01CD2D87979B5E0E34B5216F99F63BCF5B9AC216631525BD2A960F063F325820262D616053E36A8FFDD3BE67543B5D33963B0
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?>.<grit latest_public_release="0" current_release="1" output_all_resource_defines="false">. <outputs>. <output filename="grit/inspector_overlay_resources_map.h" type="rc_header">. <emit emit_type="prepend"></emit>. </output>. <output filename="inspector_overlay_resources.pak" type="data_package" />. </outputs>. <release seq="1">. <includes>. <include name="IDR_INSPECT_TOOL_MAIN_JS" file="main.js" type="BINDATA" compress="gzip"/>. </includes>. </release>.</grit>.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\resources\inspector_overlay\main.js (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
                                              Category:dropped
                                              Size (bytes):79113
                                              Entropy (8bit):5.556792880818279
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:893A2B9EDC9C85781D6FD211D52AB83D
                                              SHA1:A413A94C401BBE3634F92163D2806EE197F770AB
                                              SHA-256:6853E8DD17008B5E03DAD3F6D464EAA92BAF969345E305AFAE6FF3C3355BE93E
                                              SHA-512:1861B0D819F82EB4E45A62E9A72A0316D52E5B3AAFD5D9854F10D76E36E145E50AC9E1D2A38A091E9C4B0B44D4DA2B4717B2E1640D90552719F1E80ECB34CB9E
                                              Malicious:false
                                              Preview:!function(){"use strict";const t=new CSSStyleSheet;t.replaceSync('/*\n * Copyright 2019 The Chromium Authors. All rights reserved.\n * Use of this source code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\nbody {\n margin: 0;\n padding: 0;\n font-size: 13px;\n color: #222;\n}\n\nbody.platform-linux {\n font-family: Roboto, Ubuntu, Arial, sans-serif;\n}\n\nbody.platform-mac {\n color: rgb(48 57 66);\n font-family: ".SFNSDisplay-Regular", "Helvetica Neue", "Lucida Grande", sans-serif;\n}\n\nbody.platform-windows {\n font-family: "Segoe UI", Tahoma, sans-serif;\n}\n\n.fill {\n position: absolute;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n}\n\n#canvas {\n pointer-events: none;\n}\n\n.hidden {\n display: none !important; /* stylelint-disable-line declaration-no-important */\n}\n');class n{viewportSize={width:800,height:600};viewportSizeForMediaQueries;deviceScaleFactor=1;emulationScaleFactor=1;pageScaleFactor=1;pageZoomFactor=1;scro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\v8_context_snapshot.bin (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):642377
                                              Entropy (8bit):5.1998846752068415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25F04D46B9A498FE87545046C6087056
                                              SHA1:1979BB74E2B33AF5B2B57E71E7676F009A04F4B6
                                              SHA-256:0CFE6903A57AEE9AF4BF5B7865CE75CD9A5D9BE5FECDA1965582A4E9E76A45F1
                                              SHA-512:1191F229107B060AB9BE96624CCBAADAEF892539000E27AF352A22215F590875028E27C34853905730E7A33845E0152F28E7B8B8EE45A42481EEDD58F601ADE1
                                              Malicious:false
                                              Preview:...........r....12.0.267.14.........................................................i(..i[.......z..............a........a........a........ar.......a2.......a...........rt....t...2u....u....u...Rv....v....w...rw....w...2x....x....x..(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.Native.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.879927360305737
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FBA237EEE9835FA8EF86AF92D9CC8CD2
                                              SHA1:6A0E87137EC33A70763E29AC70FD119EF2AF9CF5
                                              SHA-256:86AD0C89AFBFA047B23427B866141596449F44A89A8748B782D73315A25637CD
                                              SHA-512:6BAAA2CE92E318A12C144C48FFA1C0B8C169A7F6C72C4C7DCA82BABE3F4947685F5EC84E3DB72AA1FC70D27DB5AEFDE20A2F0D22E9DB024290342E98D1D999EA
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x............."...0..............<... ...@....@.. ....................................`.................................C<..O....@.. ....................`......x;..8............................................ ............... ..H............text........ ...................... ..`.rsrc... ....@....... ..............@..@.reloc.......`.......(..............@..B................w<......H........&...............................................................0..7.........(....}.......}.......}......|......(...+..|....(....*..0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..*.......(....(....(....o.......r...p.(....(......*....................(....*.0..<.......( ....o!.....{......i(".....o#....{........io#.......&.....*........55......N..}.....{....o$...*.0..G.........(....}.......}.......}.......}.......}......|......(...+..|...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.Native.exe.config (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):186
                                              Entropy (8bit):4.942919098144707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9070D769FD43FB9DEF7E9954FBA4C033
                                              SHA1:DE4699CDF9AD03AEF060470C856F44D3FAA7EA7F
                                              SHA-256:CBAF2AE95B1133026C58AB6362AF2F7FB2A1871D7AD58B87BD73137598228D9B
                                              SHA-512:170028B66C5D2DB2B8C90105B77B0B691BF9528DC9F07D4B3983D93E9E37EA1154095AAF264FB8B5E67C167239697337CC9E585E87EF35FAA65A969CAC1AA518
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2"/>.. </startup>..</configuration>..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.Remoting.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):4608
                                              Entropy (8bit):3.936494912616784
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B7BA072AAEC4A86B5BD427DA28A51AE
                                              SHA1:FCD78D6A109703EB6C691263ADE979ECDC68CA46
                                              SHA-256:3B5E5FA773FD749C1429E56FC252DB0919BC698BD3084AF58760AAEE097DDA88
                                              SHA-512:DE6AB6B23AA81A2833E452059D373E321C9F121B82CBC330F3D726BC3828424D4C0B1E9F83D8124825A8A0E71F386C3A3D1BE4C3A35EC6189E4C3BA52FCD4CE4
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8V............" ..0.............J)... ...@....... ....................................`..................................(..O....@.......................`......0(..8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................))......H.......P ..............................................................BSJB............v4.0.30319......l.......#~......0...#Strings....0.......#US.4.......#GUID...D.......#Blob...........W..........3......................................................K.........j.............................M...........................................................'.^.......................A.........'.............\.......................V...q.V...q.......................n.t...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.application (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (550), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):1812
                                              Entropy (8bit):5.2113294172684235
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CACAE3835B5778B23A0A95E634D2BF29
                                              SHA1:5C3CF604C01A92970F12AD796E3CF6758FC98757
                                              SHA-256:1CD3F291E7BFA1BA96E522ECF36E7E849302A7925A106D572A93B9A763072E8A
                                              SHA-512:8DF153A438E0827FCACAE1DC7593667F5BBA80B509C235B55E3572DE48AA284079D70DAAF27C5BCCD97147FE59628A730025CC2EF8E4F4A46DCB274CEB17EDBF
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="Clear.application" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="Clear" asmv2:product="Clear" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="true" mapFileExtensions="true" />.. <compatibleFrameworks xmlns="urn:schemas-microsof

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):5407792
                                              Entropy (8bit):7.269144159853683
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:26AE5F1918D76D1221ED90C7183BDC84
                                              SHA1:404517A0671B41212A9332A195F339BA8E8355E6
                                              SHA-256:F685D405EE59002A2A8A08D98E129322ACCBB0C48153E19E4E1127A583E4BCFB
                                              SHA-512:0B33B03D4EF15653E3F0968D0F791306EA9342F4CAF0CAA9FB95C60799D4E37066DA335E6430B2B0C65BF9C91AB7C855CD6D69517B5DC2B303EA574000ADBC2E
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t............"...0...Q..~......F.Q.. ....R...@.. ........................R.......R...`...................................Q.O.....R..z...........\R.0(....R.....H.Q.8............................................ ............... ..H............text...T.Q.. ....Q................. ..`.rsrc....z....R..|....Q.............@..@.reloc........R......ZR.............@..B................'.Q.....H...........d...............P^J...........................................{;...*..{<...*..{=...*..{>...*..{?...*..(@.....};.....}<.....}=......}>......}?...*....0...........u........|.,w(A....{;....{;...oB...,_(C....{<....{<...oD...,G(E....{=....{=...oF...,/(G....{>....{>...oH...,.(I....{?....{?...oJ...*.*.*....0..y....... ..a. )UU.Z(A....{;...oK...X )UU.Z(C....{<...oL...X )UU.Z(E....{=...oM...X )UU.Z(G....{>...oN...X )UU.Z(I....{?...oO...X*....0...........r...p......%..{;...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe.config (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):19624
                                              Entropy (8bit):5.015005614388246
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:427C4795260B4AECA74D6FA4AF6AE6E5
                                              SHA1:7FBDAF86BD9D5527EAF883AF701DC535C4CEA4AC
                                              SHA-256:5469472596BBE3058A2A89F1D5B0880A53A0A450159A240BD24F503B77B088D2
                                              SHA-512:CA00D0F23C7AD323C27CF109405F4E7310397632C19A49FD6B71E5A0717D927527470CB563F96A6B772FDD1AA5FCCFC230B6F5DE8B517835892A6F0E062C0FFE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="ClearBar.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <runtime>.. <AppContextSwitchOverrides value="Switch.System.Windows.DoNotScaleForDpiChanges=false" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe.manifest (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF, LF line terminators
                                              Category:dropped
                                              Size (bytes):96683
                                              Entropy (8bit):5.257126320655635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C3757A5D36911A561AAA7E7A70E712B
                                              SHA1:E766D4835E1FDC89F22894CB07324FE9CE2E6972
                                              SHA-256:49110DCBD7ED10E54A5A5F6756CF179FEED6121EF9E9277C53C9DF8E1C6786EB
                                              SHA-512:A3674017867FD76225D525C8F59C02097639ED016024FAF73CC82D897DCBEDD02A16991DC504E707D69BD54E69029DC8E483F83C1DAD78E88651FC141D789ED0
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="Clear.exe" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />.. <description asmv2:iconFile="clearbar.ico" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <application />.. <entryPoint>.. <assemblyIdentity name="Clear" version="1.1.3.0" language="neutral" processorArchitecture="msil" />.. <commandLine file="Clear.exe" parameters="" />.. </entry

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Greensoft.TlvLib.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):4.280980574705485
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B3C796CFC5C246A20207CF719C71C37C
                                              SHA1:A00511E18C3C8C72012F0C51E76BA44501969CF5
                                              SHA-256:9127EADFF877E7142AFB0E4239F77A52C47438A7A0A467E7744CAD07537DF04E
                                              SHA-512:2BDCE40BFA6C4B716AC637D7231744A5DC105DE8FF642D15552FFC3780984130FE0B5F553F29F9FD8B7BC868424CB5D5BF51A19E1C432E21BC375D8C90C48638
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............>4... ...@....... ....................................@..................................3..O....@.......................`......\3..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........%..@............................................................0................2.r...p......(....s....z.o.......3$..1.rw..p......(....s....z.........*.,..-..,.. ........X...b...`...3...._.....s....*..... ...._:w....s....*.0...........o.......3.r...ps....z. ...._-..s....*....._..-..........*..1.rC..p......(....s....z...+$.o.......3.r...ps....z..b...`....X.....2..s....*....0..............8.......Z.._d......._,...0j.,).-...._..3Sr...ps....z..._...@r6..ps....z.-.. ....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Hardcodet.NotifyIcon.Wpf.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):97280
                                              Entropy (8bit):7.267366315163259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37391572EFAD4B7DF720123D7A35EA6
                                              SHA1:512B4EF31601998E3749223E067A96C95E3E3F78
                                              SHA-256:6B7A81F9A501F36FE050D94E57DC7456B1C63C58BFB214863FE9748A2A22D146
                                              SHA-512:6866D4995499ACF40D6102B2BDAB27B951879523B2FCDC61C40793811B1CED7130DAC2C9CB5B865268E8C4B2FA28AC5F92E4B4AEA81833A7AA262DE75B4AE68D
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..p.............. ........... ...............................T....`.....................................O.......................................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Humanizer.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):308840
                                              Entropy (8bit):6.45239473803924
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C687CBDEA0138936FC4B88B3086207CC
                                              SHA1:93C188E269C21893DE07642AF022318ECAE31BAD
                                              SHA-256:2C522CD285DE2E3A02520F91203F548E454B980821F10DF90E801BD7D3F5C43E
                                              SHA-512:2692EE13267F1801D283B03DAA46CFA61E72E308CE441036F87E6A8492999113B5C82D89173E2E9E0DC64B0867592B24B031CE4E8652ECE4D3F281189C547F11
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u............." ..0.................. ........... ....................................`.................................D...O.......................h ..............p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H..........H................F............................................(....*..(....*V!...7....s.........*...0............-.r...ps....zr...ps.......i.I......+b....o....,H.......rY..p.o....o............rY..p.o....o....rY..p.(..........o.....+......o.......X....i2..(...+.*..0............i.I......8..................o!...o"...,)......r]..p.o....o#.......(.........8^.................o!...o"...,)......rg..p.o....o#.......(.........8..................o!...o"...,)......rm..p.o...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\LiteDB.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):488448
                                              Entropy (8bit):6.015215990524562
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BA42FE7DDCCC9DB8F8BFEFDF4178C67E
                                              SHA1:CC28125DEA3F4BF77A564E4E09A8B09BCD2AA446
                                              SHA-256:85B3596AD0E426646A774FAEC082E612AF0121A03CE8790412B6E6808CE2A3F1
                                              SHA-512:9843638E19D04B946830E7039BF195EED70A174F3F1A9DBF6F3612E18626CFC72E5B95858E1D1CAE3FFB4777D92738A2FB5A2CE53C4CDE1F6A854EEFEB94E5E7
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H'..........." ..0..l............... ........... .............................._.....`.................................R...O.......................................T............................................ ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............r..............@..B........................H........c..<&............................................................{J...*..{K...*V.(L.....}J.....}K...*...0..A........u;.......4.,/(M....{J....{J...oN...,.(O....{K....{K...oP...*.*.*. 8..z )UU.Z(M....{J...oQ...X )UU.Z(O....{K...oR...X*...0..b........r...p......%..{J......%q>....>...-.&.+...>...oS....%..{K......%q?....?...-.&.+...?...oS....(T...*2.(U...oV...*..-.rE..psW...z.(U....oX...oV...*:...(....(Y...*:...(....(Y...*N..{Z....o...+(Y...*z.{[....{Z....{\....s]...(^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Bcl.AsyncInterfaces.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):26752
                                              Entropy (8bit):6.512503595653532
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:970B6E6478AE3AB699F277D77DE0CD19
                                              SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                              SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                              SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):48256
                                              Entropy (8bit):6.234996524588368
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                              SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                              SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                              SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Extensions.DependencyInjection.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):88192
                                              Entropy (8bit):6.25584016939133
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4186A905DC180A0CC2110403727BD792
                                              SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                              SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                              SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Toolkit.Uwp.Notifications.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):162448
                                              Entropy (8bit):6.204693784639812
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:805135DA62C5B65618B9782A5DC48F06
                                              SHA1:4F074C676E8A93EA4E618DB0E2AF4D5D2463AC17
                                              SHA-256:A0B5BE9580BF6548F685D79E5439F6D946EF57E013D201F946B2A894E7441804
                                              SHA-512:8594AEF25DB9E73DBAD999F6E4CBFE548FA82E41D94C6396F51213809BAB01B043C1238171CD44FC962E0F53050E4067A449AEEC07FD23B511A1003E71E2BB65
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....G..........." ..0..F...........e... ........... ....................................`.................................Qe..O.......p............P...*..........\d..T............................................ ............... ..H............text....E... ...F.................. ..`.rsrc...p............H..............@..@.reloc...............N..............@..B.................e......H.......l...p....................c........................................(*...*..(*...*^.(*......d...%...}....*:.(*.....}....*:.(*.....}....*V!..R{*....s+........*..{....*"..}....*....0..Z........(....o,...-.r...ps-...zs0.....(....o.....+..o/.....o+....o5...o0....o....-....,..o......*........*.$N......J.s1...}.....(2...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*6.|.....(I...*..{....*"..}....*..{....*"..}....*V.(....-.r...p*.(....*..(J...%.(....o>...%.(....o@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.900655456226697
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:76B8D417C2F6416FA81EACC45977CEA2
                                              SHA1:7B249C6390DFC90EF33F9A697174E363080091EF
                                              SHA-256:5EAA2E82A26B0B302280D08F54DC9DA25165DD0E286BE52440A271285D63F695
                                              SHA-512:3B510CDC45C94BE383C91687C2CB01A501BA34E3FBB66346214FC576D6F0E63C77D1D09C6419FC907F5B083387A7046C0670377AD2E00C3EC2E731275739F9C7
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Microsoft.Win32.TaskScheduler.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):333824
                                              Entropy (8bit):6.105576145657233
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A844AC745A4005FBD3F51D79FF88583C
                                              SHA1:92671774FD4BE9781A77D2788A8DDDBF8981EAD5
                                              SHA-256:74FE1A6A1E36BE7D893E31BBB4D4BD83BF4B927E715276CD5607982139818EBD
                                              SHA-512:5F0734058D9146FFEB552ABF443DF5097CF134A4737BED499467830E08D97F5D1996C1F1647C5C12289CA4D4209EFFD480010AFEBC59D50290D4CA7D45BB41F8
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ..............................I.....`.................................0-..O....@.......................`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{....*..{....*V.(......}......}....*...0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(....*..{....*..{....*..{....*r.(......}......}......}....*..0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Newtonsoft.Json.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):701992
                                              Entropy (8bit):5.940787194132384
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:081D9558BBB7ADCE142DA153B2D5577A
                                              SHA1:7D0AD03FBDA1C24F883116B940717E596073AE96
                                              SHA-256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
                                              SHA-512:2FDF035661F349206F58EA1FEED8805B7F9517A21F9C113E7301C69DE160F184C774350A12A710046E3FF6BAA37345D319B6F47FD24FBBA4E042D54014BEE511
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ..............................*^....`.....................................O.......................(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{]...*..{_.......-..*...0...........-.r...ps....z.o......-.~....*.~....X...+....b..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpClipboard.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27648
                                              Entropy (8bit):5.804767406769817
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27E89E536FDD09F8D2C5911C6B57AD90
                                              SHA1:1250FF1AA36A20528F7A489B5F29764E7D85CE40
                                              SHA-256:CBD69D92834309D6D1DB85489627ECFDEFC534E7E1DC1D6EC06B0BDF2723044F
                                              SHA-512:B942462FE3D313DAE64E0417D5C9E13137F467AA3C55343008111B1DAFEE465641FA9A5E7E160F863D1516E31AB34776C8AB2CF0FD02D8E966BA2C74A5EB45AC
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w;............" ..0..`..........F.... ........... ....................................@..................................~..O.......d............................}..T............................................ ............... ..H............text...L_... ...`.................. ..`.rsrc...d............b..............@..@.reloc...............j..............@..B................%.......H.......d3..8>...........q..X............................................0..f........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( ......('.....(.....*...0..n........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( .......o!.....('.....(.....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Converters.Wpf.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):147456
                                              Entropy (8bit):5.921251663921899
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6B4D48DA8444E195EE9F7DBD54509050
                                              SHA1:93C7BF74A27D1721F5019F974EBDB23E4EFD77E9
                                              SHA-256:E3A24CB86E4C5C563A4C639E84A02F679752DFD9593076E6C4C2C79063BC580C
                                              SHA-512:D6C647C2F60A0C064A4507DDF95F3EE6BA45222A84DB824165814FA5044E2FC3D0DCEDBABA4334D4016AD2179CA6913B6505F5FF61BE443CAE871584E4FC8AE9
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[..........." ..0..6..........jT... ...`....... ..............................7%....`..................................T..O....`..............................LS..8............................................ ............... ..H............text...x4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B................KT......H........2..@...........LJ.......R........................................{-...*..{....*V.(/.....}-.....}....*...0..A........u........4.,/(0....{-....{-...o1...,.(2....{.....{....o3...*.*.*. Q... )UU.Z(0....{-...o4...X )UU.Z(2....{....o5...X*...0..b........r...p......%..{-......%q.........-.&.+.......o6....%..{.......%q.........-.&.+.......o6....(7...*v..(......}......}......}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Core.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):183808
                                              Entropy (8bit):5.883721718575946
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:102AA7B6DF14A1B8BC85D63BA6324CE3
                                              SHA1:F67A2C49147395D254745CBA85D3B6C3BEB1F8D2
                                              SHA-256:DF734FE868BD7878F13E52F4DC3EE5DF47735991965D6640D91AAABEA85297C9
                                              SHA-512:F3A1B3F81C9A0A8BD7AD28CFAA7EE394D8486F21C5044559D8DCA66D5FBDB2FF7E5360F6B06F481CFD256F4F764ABF9C2101EE0B4EC6856A6D0C6322CBB015DC
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rgj..........." ..0.................. ........... .......................@......9.....`.................................H...O............................ ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................|.......H........J..|..................................................................-....v....*.......uv....v....v....qv....v......*.......-....v....*.......uv....v....v....qv....v......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*2.s....(....*"..(....*..0............(......-..{.....o......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..).......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Css.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):91648
                                              Entropy (8bit):5.476131785053364
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2505206D82B85F5C8658441F0D100CDF
                                              SHA1:685D0A1AB32DF7B012E896F01CA76DDABCF67499
                                              SHA-256:3BC7D23F2F44AB3F7F8FF9E00289B49E6A5E990DA1F8DC92FDB138D6DA16B403
                                              SHA-512:F699F0E997F2F63F4533A0F7D436EEED99490DA7A944A8D99368661A5E8DEA4A5869DD2C3FADFDD8AF76BD97F226D68B6BFD9969DEF3597F340E539C159A1FD0
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..\..........B{... ........... ...............................b....`..................................z..O...................................8z..8............................................ ............... ..H............text...P[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................"{......H.......\...\....................y......................................2.~....(....*f.(.....s....}......(....*..0..G........o....-..*.(....,..{....,..*.j.+..{......o....o....,..*..jX...o....7..*..0..7........o.......o.....1%~.....o.......+.......(......X....i2.*2.{....o....*..o.....1-.{.....o....&.{.....o.....r...po....,...}....*..r...p( ...,...}.....{.....o....&*6.{....o!...j*....0..W.......~......{....o"....+..o#......r...p($.....o%...-....,..o&.....o.....1....o.....Yo'...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Dom.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.474871175289035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3453AB2CC06145E8B65FF572781DB0B2
                                              SHA1:12D6CE422A96D1FBFE62C07427C41EF446357229
                                              SHA-256:99EB1DC3D85D8AD6F6A443D621870E256C43A2DF6C7D9DEBE564FCE06ACFBF67
                                              SHA-512:FBDC6E62507E2C5B1B67B87114E65D4EF0C8C9F05FCEEAD1EFDD517415A5BFD5EE52A7E54A4D8DFF2016B361BFCEEED3BBAA0A6EFB2309F6067CF71FD29ADE76
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..|..........B.... ........... ...............................t....`....................................O.......|...........................8...8............................................ ............... ..H............text...H{... ...|.................. ..`.rsrc...|............~..............@..@.reloc..............................@..B................".......H.......x?..@Z..........................................................b......(+.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*6.{.....o....*V...(,.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*..(-...*....0............(.....o/...u......,...o;...*6.{.....o....*V...(0.....s....}....*>.{.......o....*>.{.......o...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Model.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):1072640
                                              Entropy (8bit):5.857610826427647
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5C0C906E41C10498072B74C065FF8FC5
                                              SHA1:B3F2FC11BCE6A10A4F402A964F03170952E36BD1
                                              SHA-256:785F8E36FE70214F3D5E36A1034AF65917C9ED9A157A6CBADF1642C240F4E736
                                              SHA-512:6AE9B9A8298FF540932D98E9734CCE40012BDE33753415E2A1171D7E036411F5287CF639E509A59DE3D0005BD946FEF457BC92EE1945973434C326E1C4A368B6
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z..........." ..0..T...........R... ........... ..............................4_....`..................................Q..O.......|........................... Q..8............................................ ............... ..H............text....R... ...T.................. ..`.rsrc...|............V..............@..@.reloc...............\..............@..B.................R......H........@..................U...P........................................{M...*..{N...*V.(O.....}M.....}N...*...0..A........u........4.,/(P....{M....{M...oQ...,.(R....{N....{N...oS...*.*.*. $.. )UU.Z(P....{M...oT...X )UU.Z(R....{N...oU...X*...0..b........r...p......%..{M......%q.........-.&.+.......oV....%..{N......%q.........-.&.+.......oV....(W...*J.(O....sj...}....*f.{.....ov...,...}.....*.*J.{.....ow...,..*.*J.{.....ox...,..*.*....0..........(X.....(Y...-..{....(Z....+.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Gdi.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):113152
                                              Entropy (8bit):5.967666840143916
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72D4D1734FE9492F8507219FD9D8DC64
                                              SHA1:970E9CED151576D9F8D7E52AA0F312A0059002DA
                                              SHA-256:986F96B0774CCE5A3A4389BC5E3D8C9B7A69D107B7DAA47607CCC41E20EA217F
                                              SHA-512:8E0E4B29D88ABE82CF856D9AC940A64BEAAF354A8E901ABF53A52C579E51D9BC969322E3CE3A6ABF8C7B45A73BD2BE41C74EC9E120B895D305308D6A3927E237
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*n7..........." ..0.............F.... ........... ....................... ...... .....`.....................................O...................................(...8............................................ ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................%.......H.......D................................................................0...........-.~5...*.o6...9.....o7...o8.....(9....... :..B...... .k[c5[.. _..,5).. '..;...... W..#;...... _..,;....8j..... ..K;...... 1H.L;...... .k[c;T...8A..... .n.w5).. ...l;...... ~LUo;T..... .n.w;....8...... ..B.5... ..P.;...... ..B.;....8...... i...;...... :..;]...8...... 8`..5u.. ...5).. .K..;...... .r.;...... ...;....8...... )..5... ~.d.;...... )..;....8k..... BB..;...... 8`..;....8N....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Rendering.Wpf.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):229376
                                              Entropy (8bit):6.015136394443516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:57CDABE8A4465F184EE7C9F00F796996
                                              SHA1:27C70AF6271700FB3F84616C9EBEA155ABCB0604
                                              SHA-256:0712A1E8E2A9887DB18439DC3F3FDD6F8B367F514A47FB70A38FD6121C388E02
                                              SHA-512:BABDA13B581C9B09ED70C59C89C6F59C951F3B7F85D915702B47D3C7DDB7179B6C799BCB445A4E08C64977B047630EF465F77A1EC5DDE6D0D8385582B58B5622
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..v............... ........... ..............................eD....`.................................Q...O.......................................8............................................ ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B........................H...........L...........P...............................................2.~....(....*:.(......(....*..{....*..~....}.....(....-..(....,...}....*.s....*..0...........r...p(5....~....}.....o.....3 .o ...~.....{!...("...,..o#...,.*.r...po$.....(....-"..(.............o%....{!...("...-t*.o.....3H.o ...r...p.{!...("...,R.r+..po$...r5..p.{!...("...,5..r[..po$...}....+".o......3..o ...~.....{!...("...-..o&...-.*..0..M........rg..p(5....~....o'....r...p.(.............o%...o(....r5..p.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\SharpVectors.Runtime.Wpf.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):72704
                                              Entropy (8bit):5.973895173040258
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55E564E90852CDA28B7CAF06225832CF
                                              SHA1:CE049650E93CE17E737F86C28EF2165C7E256A6F
                                              SHA-256:C75ED43EE8DEDB510AAC00DB08851D54A6DBB16F38B804D5A69CF72A355C7672
                                              SHA-512:D99BE1899050252E7D10B71CF39BDAC897A254BEB12FFCD23E433D225D155E35FC3E6505AF47D681465AF6680D513D9692E761BFA855801C9DE07D4AF5A2E9FB
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............1... ...@....... ..............................i"....`..................................1..O....@.......................`.......0..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......Pm..............d*......<0......................................f.#.......?#.......?(....*&...(....*.0..S........(#....($...-..#........5.r...ps%...z.($...-..#........5.r...ps%...z..}......}....*..{....*..{....*..{....*F#......X@.{....Z*F#......X@.{....Z*..0..6.......r)..p.{.......r/..p(&...r;..p.{.......r/..p(&...('...*^.u....,...t....(....*.*...0.. ........{.......((....{.......((...X.b*.0..2........-..*.{........{....()...,..{........{....()...*.*f.-..-..,..-..*..o

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.AppContext.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.887075475210058
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8CC4C7DFEB41B6C227488CE52D1A8E74
                                              SHA1:93702135DB0646B893BABE030BD8DC15549FF0C2
                                              SHA-256:9DC115AC4AADD6A94D87C7A8A3F61803CC25A3D73501D7534867DF6B0D8A0D39
                                              SHA-512:E4DA7E3AE5CA31E566EA0475E83D69D998253FB6D689970703A5AD354A2AAD1BB78D49A2C038F0A3C84A188D091696191B04E4A39253DEB3B6CB310B72F02F97
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ..............................ZY....@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Concurrent.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.941945190587086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:559C98EB9633C7BA1BC813F8E6E0E9A5
                                              SHA1:311F52B31611E6DC5FD4C0159BFA452C22980CA7
                                              SHA-256:CC62F3B867D50083C2932061F20662C698D2E1A741C4D2F9DF1FD2D435E3EF3C
                                              SHA-512:E241C16869D1CDBB2C6482A7C5B2AF93DE4BA0CEF8185B8826EEE35ECB174F35F7585C8AE0320F7F4F6B80F3BB5B3EDAE2383760F2F35637F03C3A0E38E0875C
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.NonGeneric.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.939816403058967
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:45FF71114047DBF934C90E17677FA994
                                              SHA1:526C688E71A7D7410007AD5AA6EA8B83CACE76C5
                                              SHA-256:529943C0CDF24F57E94BF03FAC5F40B94A638625027A02DF79E1E8CB5D9BC696
                                              SHA-512:29684AC5391268EAA276196A6249364F6D23ABFE59BDC304A561CF326CEA6CD662FA04C05E15924FD6D3F9E9D1607992B8DCAD3F817CFE891580F9D9462FE9B7
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................>....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.Specialized.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.942827969586567
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B52C339601CB264F83DF72D802E98687
                                              SHA1:8BBB7BADAAA912C1F17775E9ACDCAB389704C772
                                              SHA-256:938DA38561DA54793944E95E94B6E11CF83AACD667487297D428FBCE1C06DC9C
                                              SHA-512:287F08AB07827570F9F3EF48A6D7E5C186899A2704FB3DBAF36975F6BE7B29FB6695A69FAB85A6F09BDDEFB60C79052C3A33CF862651F892EB9D773D880B3AF8
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................>...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Collections.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.848992181946284
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1D8AAFECA1EA565B257384D3F64864B0
                                              SHA1:4D923B100142AFA2E0A8B7ACDB3A6DE6FEB91148
                                              SHA-256:C2250E9E51B44D8AB8C5B892592766925F6580EE00B95026621D0AFB037C2707
                                              SHA-512:99E4A226E1FABB348E7EF7C6FA56AD0CE4E4CF5D8569CE21881703DCA8D83A1C113FD5F440A4FC9E9B99A04AE8CF4490E17D62FFC09CFAC5A45678A4419EFDBB
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............*... ...@....... ..............................J.....@..................................*..O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..|....................(......................................BSJB............v4.0.30319......l.......#~..|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k...........*...0.*...M.*.....*.....*.....*.....*.....*.....#.....*.....x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.EventBasedAsync.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21768
                                              Entropy (8bit):6.880530414500754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6067ECBAB3C6DDDB6BF7C49C7948CAA8
                                              SHA1:5F3DA777AF01DBC159BD8D9D97D5DC105918AFC5
                                              SHA-256:22108E32E0B6E42F5F52A4CB17B9B6FA3DFD547ECD9EEF9C67226DBEC54D23E5
                                              SHA-512:9F3E834B8342E0C7AA5CCC993B520D664B03F1F0091066C66067923E1D4991EFA03F63908552538C05F423AA2B696DE7C76993F71A7564F3E87662CB0FC00726
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$*......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21752
                                              Entropy (8bit):6.916008128976572
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F39655CCFC010E32A7240D9BF5D0852
                                              SHA1:20AEAED12DFB8D71E39687350EB12BC0DE372AF0
                                              SHA-256:BFCD867F71C887429DFE008D7EC5D1853D15B3932D4CE8991694293477B5BE37
                                              SHA-512:9769E59279A32F29C2F2C6970C81D3ED76FE3421B819DDFFC8FA98329F1B45300C737FDF71956672F80F69B3A75727D184F8C421E00B84E94163A86CB744A991
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ...................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.TypeConverter.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22784
                                              Entropy (8bit):6.859096700065679
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1699287934DA769FC31E07F80762511
                                              SHA1:BFE2384A92B385665689AD5A72F23ABC8C022D82
                                              SHA-256:0DBB92ECD5DFA7FC258BC6DEED4CECF1B37F895457FD06976496926ABDB317BB
                                              SHA-512:4FEF3E1535F546FFDDE0683F32A069BEEFFE89096524C7068F1F5CE8377824F82AE530D3990C9DD51BCCAA9E53FDED5613FA1174013325808059276DEE771187
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................:.....@................................../..O....@..p................?...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ComponentModel.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.910097922783346
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:632CC8AD69B76FD9BB5847DE1E1439F7
                                              SHA1:2E32D50EC33EC6635681485B754F4E58D434A5EE
                                              SHA-256:5E61D755616CB10524F5F31E9B70C65A7FFF8E30E25CE711AC8B354D657AB479
                                              SHA-512:9BA5CC82573308E5D995BA05BC660FC1C087EB91D8BD7EFCA6FF838A3C47BD6118D9C92919B2E0DAC11A5A27977318C5C819499DC19CD5D6E57122A0749858C6
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`......|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Console.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21160
                                              Entropy (8bit):6.908265030965905
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA9376C17EE0148F0503028AD4501A92
                                              SHA1:9D5686CBF45E90DF5E11D87E7B90173A1A64B1A0
                                              SHA-256:B537313413F80105F143CC144FEEAE2AC93F44747727DE309A71D57D2650034A
                                              SHA-512:18D1BB2D5C469644078D75766DBF04ADDF7D0C543F7ED15FF522CEEAEF960900DD8EC68172F5D684B76B0AA6946BB38D641F021EC04C70AD66A6062C10412E0A
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ...............................U....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.Common.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):154448
                                              Entropy (8bit):5.513799122521585
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D712A5A82A446086443CE00B610D8A5D
                                              SHA1:7ADD96BAA123DB819F2F3D5AA62D6F872CE8FE14
                                              SHA-256:1C7BFF6F16BB618648E699B723AEAFE511515CD6AAD699C25FAAE2A507E22811
                                              SHA-512:225128E58E2F01B5CAADA6FE54B1D32FF6A700542CE22B425649AB22DA2944F796F04D1A2428C542BCAB5348A161CF73F5F9A1E7BBF1F6417C4D507217FE3FD0
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................DR....@..................................,..O....@..................P?...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r;..p.(....*2ro..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rK..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rM..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Data.SQLite.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):402336
                                              Entropy (8bit):6.138265912892721
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:147328DEF2E79A86D7335A661EECC051
                                              SHA1:98FF30131D77CF28807D50B97CC92CC8655E235C
                                              SHA-256:7442D48A24C1747CB17D80E95C4D7343DE16E14A252484ACE3BE3FAE55B1D641
                                              SHA-512:D26F6627F09CAB90AE545DF68F2DF006F0BEB988CFADB16F6AF56A454E854A9B9C10D2CE787052B80536F9D05B7286D57E42F361F54944E20DF99B3C1C49AEFB
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.........." ..0.................. ........... .......................@......Ez....`.....................................O.......p................I... ......|................................................ ............... ..H............text...D.... ...................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B........................H........7...#...........[..P...........................................:.(;.....}....*..{....*:.(;.....}....*..{....*...0...........~<...}.....r...p}........(.....(.....r)..p.(........(;.....~<...(=...,z.....sj...}.......}.......}............{............%......(>....%...C....%...!....%...%.........%....%.........s....(....*vra..p.(....,...}....*..}....*..{....*z.{....,......(>...o?...s@...z*.0..(........{....-..(......o....&....(V.....}.....*.................0..T........{..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Contracts.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.879068263314492
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99373AB10858746AAD424F28B48277F5
                                              SHA1:5042EE630A6C7C2986E8323A14D052C1D83B6F61
                                              SHA-256:9C4AE61E0E8365762EFE3D34C5595029F2C12E0079E6070720E2CEF0882C84E5
                                              SHA-512:E96F8FDD6FFB702D344746CE82DE576BBA8636EDE3E39A7DA18CCF8A0178B8346FD31140760B864F1487D7804D931FF1A18DE07A4CAFA0CF79BDB340421FC03F
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ..............................mG....@.................................x*..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................*......H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Debug.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.940882019021464
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8B8C402311D7AB87E588675E736414FD
                                              SHA1:EB8C010A35B461402C1C33133F1B61C78BE8425A
                                              SHA-256:55A30D92D163CF1807BEA6DC13B4C13E70AEBBB034DC77EAEF4F4394730DCD8E
                                              SHA-512:D03F450A3A19320DE71145E48CD7C088D9B50D0A683CC9A79D8967DCE085A6F63CBE537FCA1C6208865EB52EAFB10189613C7233047318CAEB2FB2C23C34A269
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.FileVersionInfo.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21248
                                              Entropy (8bit):6.908174280383857
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0D9A641105098D642567B22101A4DE0B
                                              SHA1:12419C25D1C2EB706A4E4E649EE353CEDA7446A9
                                              SHA-256:7C25A74772E135257235640A0264DDC05235E14F3627896CFE735E9955155F83
                                              SHA-512:FD4560CDF01DE237DDF797A33C5DBC220D3FCAE07EDE17D43C39F5562E36E03646676A87E20699D7603FCA6D84F66C8756EB863DD4727B7E1A499619BB88DDE1
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................@.....@.................................H(..O....@..p................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Process.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21728
                                              Entropy (8bit):6.856791185052111
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D86B0ACA05321569D9383DC7C4E9E934
                                              SHA1:2EF7D0A222C3A3E564B3C72D5B71A5BE40A7ADEA
                                              SHA-256:28B165CDDB82A2507114394AE398995EF8A50C549214F8678AA66054F6927754
                                              SHA-512:5959E1129C983825233A07869DD1B2B1DB32830D2B5F6B7F8D869C39A76A241F88F76D37341FDFBF56F000FC6ACBA19AEB36A7EFB94721494B41B65BF4978651
                                              Malicious:false
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 0%
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............**... ...@....... ..............................vC....@..................................)..O....@..0................>...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................*......H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.StackTrace.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):23936
                                              Entropy (8bit):6.756576538241564
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA98A0F020248C2BE1DD40C07092F22A
                                              SHA1:EF6B3CCFF90BEDDAB5CE6F60B4CC23F75EDFD009
                                              SHA-256:CAE99F910874288AFBF810968D13B79D755CD4B2006609EC036EA4934181CBA5
                                              SHA-512:554A25C761102DC41A9E421621E329868D1162AB29F47E59754C8FCFAE0C12BBE8200E1B5975ABF926F1DE0977A5407C43202AC8A2801C69A7F01D95B6A1E959
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................?...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....*6.o.....(....*6.o..........**.o.......*.~....*.~....*.BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.|.....Z...1.Z.....$.....$.......3.D.......|...F.|...c.|.....|.....|.....|.....|.....|.....Z...I.|...}.Z.....Z.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TextWriterTraceListener.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21280
                                              Entropy (8bit):6.9260824081196715
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A964808487E671BB369DBC0E4DC5A947
                                              SHA1:C3848473E42E2F9B4D0A00180EA9ADE654432587
                                              SHA-256:63EAB38EE9F4DCD686C8E6A4F01E1E2A9BB91E52B20AB4DDE0C28061E9261860
                                              SHA-512:7352368B68835ECC9C5943AE2F2BD5CAB775A7FBB018AF7683E74FAD1731A9738AE14EBE0BCCD854A223AB762FCA7EC11411FDAE865C5C6DDD034900FA55CFD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................G....@..................................(..O....@.................. ?...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tools.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.915565842835677
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27C7D752C11C3F43F28EB31968E73E2B
                                              SHA1:51E466218025126C5E524AFD2086F4AB0BF3660A
                                              SHA-256:260C6250EF9B57DCA99B4CECC533F9A34857B5A32B5351202F776163841200AA
                                              SHA-512:393D1747911A7F91F4C4F4F363A3782F24E00431478088DA454823A223A4E75E51D9B010FC5D9746E2BF0185BE90071B6CB70C777337D718B39151EEF6B486AA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................C....@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.TraceSource.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.857834679374035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37BE4CCE0ED037F8D9A7A3940BD2A2E1
                                              SHA1:96314EC1A59E4BB53C5B609BF79AD4C998A7A988
                                              SHA-256:C81A57D0634C462A6CF49844059E9B170F650CCDF0789519FFD4AE7D28E2718D
                                              SHA-512:CEDAC24F414CCE5053FDF10779DBD153FCEBAD69B3960F75A5AB1110DA18799C79DC01B30269641022FCD874A331BC2DC7CE1A7D1A60DC90E109DD55B58665DB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2*... ...@....... ....................................@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Diagnostics.Tracing.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):31608
                                              Entropy (8bit):6.6075135088084505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:60F59659DB517C2F4DD4C5C583D43097
                                              SHA1:87ED79D195D8D93AE1155AF08857F751A7ECA245
                                              SHA-256:B84B93BE455CC7D14EC0C88CE08DAFAC7B6AAC2E549C969E7126EB48C31F8B1C
                                              SHA-512:90BCEA3BAA04146F08013A832633957C6D511D5EB52270575EF9A571153384B5A02C5026361B70940775907B5BC710B2C91627EEACE432744F3B9E5E1ED509D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<..x?..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8*...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o....*"..(....*....0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....*&...{....*.0..4.................}......+....{.....".......X.....{.....i2.*.0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Drawing.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.910934602645047
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29B0A1554E54611EBBA7911049F26FD3
                                              SHA1:D707745E72D2F39374F2D28AF52AAAB7888B93AB
                                              SHA-256:2805A18724A24034AD6ACB315DAC516E479CECC5F3753204052657E560932D5D
                                              SHA-512:17558306A611BFAC6982D5650335B05EA407191290B653C028896142EBEE2ABCEB22F7D71926FBBCC3FAB8227C61A5FDA0E770ABFCA021AC7F891C9C7EE42E81
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................n....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Dynamic.Runtime.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.827241992748525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C5CADB1409F25B6A1C7A6DD4C2DF236B
                                              SHA1:A994C87352486D433A06943C01329DD721AB343F
                                              SHA-256:F600ACC811720183C639CEBE5618BAF9C8135B85B9CBDC0758BC9B2DCC6DD7A9
                                              SHA-512:6BD6E482533B9FF8FFF8823F84CDE7191A0FD5575F76891A95E99CD1F5C1122EF92B436745EC9583089445FD5EAC795181759080B1D83CCFA1EED31D9CCE3AF0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................`.....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Calendars.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.8850738754620915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AC2F4B435DDF0600D7A866F42F3B40D9
                                              SHA1:0564FF7F7E6084BD6D02D8E6A4127D1C878B3FA6
                                              SHA-256:B56FFB65B842DAAE13F3020B0B04646DB92F89801D2A2F89087D145A996D43F7
                                              SHA-512:DC3E9C3B4D732801DCF43CFD6CDD2672F01E03CB99D804A3F4803FDDB9CA9817BCFD2F96FD94B7B33DB0994F5478CE200C048DB5DBB78D3B24E950262EBF4D28
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ....................................@.................................X*..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.Extensions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25992
                                              Entropy (8bit):6.72175242984799
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7C93DE0627833900B8379FD181B7351
                                              SHA1:2CB98F9622F57A0A9E037A378519AA6A271302F6
                                              SHA-256:C7E91BD148ED22EE1FF8EBD3E58B199A30AF90AA37499BCF8DA34409672F2ED9
                                              SHA-512:1067BACC4495EACBC27937B54780B97DA62FED1AF66158E2FA492FC82B068D49BB49BC20C3C82C22D8EDD300BD7B097E14AA1E317F1789744E188BCA15D22B4D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................x....@.................................a6..O....@...............&...?...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o....*"..o....*..o....*"..o....*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*...0..K........-.r1..ps....z. ...@3.(....*. ....3.(....*. ...._,.(....rI..ps..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Globalization.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.947656997583423
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AE023BB0BEEE5189A07C7FD4E0CF3FCA
                                              SHA1:846711D4161A3950FACDEF97037898A71F4EFDA1
                                              SHA-256:56BD0C02C734ABF4D7FD1EF2E8B6A9E4BF5E4BAB4E606CD1023D63B02852FA61
                                              SHA-512:62305027AE8BB5B830630FE54F2CF9E607F9B97FFE28912C2CB15D429252668F17EAF2D7CEECF5601C889D5EA52E0B9100F115173BB11B5D6208171792833C85
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................PI....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.ZipFile.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.866908604521752
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BB1A520F25BB93ACE4DD0A060FBA677D
                                              SHA1:92BF07CCF32EB9FDF06F446A256E0271C4028BF0
                                              SHA-256:7720EE13405EA8A3C204703A181E67DC6D66835E9DF263C09D04D8B48B41EB26
                                              SHA-512:9288148EC879EBEAFD53C225854EE3BD3768BA5C7B829D6AF1251D20AC301FC27A04BEBB603FE2CDE6949BC5968FDE717E8B747337C1AD872450D26F7C36F515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................'.....@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Compression.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):110944
                                              Entropy (8bit):6.427912093819953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:33B8972FA6B00B8922210CA95E5745D1
                                              SHA1:609F31B98831327677E89E08BFF7D7322BA0F4A4
                                              SHA-256:DA18D61BB6B7D35C56CB4F392FAE0844CCA73F72A043A08994BECCB531FF3B77
                                              SHA-512:F85F03E20C8CE40BCF28D883CCD80CED755BF75D515FA66986963F0F4F5AD00BB1823D8C100A75323147B28A4916DD6C598102B18999AEB7B358C196AF4206DA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ...................................@.................................5W..O....................r..`?...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r7..p.(....*2rs..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r=..p.(....*2r_..p.(....*2r...p.(....*2r...p.(....*2r...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.DriveInfo.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918416126337718
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FCB2158FC41D97E2BB71953664B99B9
                                              SHA1:16EB49AFCA84C9E6160B4E5B36F1EC5C98470C86
                                              SHA-256:984575C44CAB17D46587AF6CC8C22C409B79BEC280FD771E6AF93A0A0C20E5B0
                                              SHA-512:1527A426F8EC9931573468929966E102012B630EC4AA370C196B2B87472BCEE696B00355ADAEB39B4151B986470F7DADA415E3F930D9678B68D3C531C8AC9B52
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918387036071988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:51B07204081BDE29A1F84A3B48554186
                                              SHA1:FCA2F72C039937357099CA6E167330E540F8335D
                                              SHA-256:5C84DD40D67C0E59906511D2B09DA8E28C454B5979EB5FDE74213F9D4BDBC564
                                              SHA-512:099EC1B84FCF6BF07142AD8CD34307C80F19A64C754ADE505AB55707075A764FBE7BFA4CE2FBAEAA09B3E61EBDB6E3D116608DF0CF77BC076C7B3119DB37A324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.Watcher.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.9502839815242545
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3772A3A7E55178EC90ECB607ABA28511
                                              SHA1:68C240D1A43DE1678EF13107B9300C544E9D5E4E
                                              SHA-256:C9E2562F1A1B86ACDB6957CF916ACED9C4F8B71EBB16DFA0050252146205AD37
                                              SHA-512:245F12B4926114EBDB39A54628A1DF2501C4A27ABD531172CC63BC96298EE0F4BE5658AE95FE730C063EADFB1B664C7D201C69C2246CFBA23ED5A4FE7EF3D14E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.FileSystem.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.922388458113732
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BFCEB4FACA75681137455CD70F8038B6
                                              SHA1:BFA0E27BE1D56BA48918A9B7CA7090AF7779A10E
                                              SHA-256:9A4595DBB128E2D8F373B3AC45478E7131F4D181B50EC821EC8CB88BD46BD5B8
                                              SHA-512:58D7E8D6FA237A6EAC018C0A88D6BF76AD9EE49B6A6790B64E68C33EBF80AFCB4223881AAC6821132B877E7D848BC917EB9490590CDB297F362C9B43143D6713
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ...................................@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.IsolatedStorage.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.911523435668273
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AB8D293BCD7A13E83565B4AFA8438988
                                              SHA1:48F227C62B2001C441BCBC5B570911F096DDF421
                                              SHA-256:0E80A2E256D16E487BC847D1857ED7CD088F176254BA2A385D675338B836B0FC
                                              SHA-512:443DD75234C043DE736423466C1FC2FF2BD9B6B9FE753521C3C225DE99F5A7D3828A470CF8EA54678A86681949E5DCD1DE1EAB35BF0F348F758FA099A9092F54
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.MemoryMappedFiles.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.952503401221548
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:34E21101FAF71A27C6819CC051DEBC9D
                                              SHA1:D9DF77B4993418337894FF04C6B813224B9F8543
                                              SHA-256:81B6527AC2D18782AC24AE463C11DD1D70AB1BC89F626B7347A592229B371A1D
                                              SHA-512:AA339F2489CA9BC9EF7F6121C9586DBD8F5AD2CA5A160A3BCAC74B908570EC2FC0BC24E0EC33AE9DE9D6A6C3557EC2816FE8E89FFCA93E310503F6F83A691F6D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................!.....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.Pipes.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.934271103866825
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:58A2E5AC0510B9223236B9317C505B58
                                              SHA1:A00954217CA326C54A863D451820263A6D7EE1AF
                                              SHA-256:80A229B2917FC3A5D941FF9745A6BE0065028AFDF9509300410D2721C71F1198
                                              SHA-512:18736ECFE0EF0C477BF64F89CA97AF4578DEFC996F0A5BAD33D7A29AF6E09745E4B10D6D543243B9664E40169EE550C996E783C5FFBB0FC767DA7FFC63E13FB6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................P.....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.UnmanagedMemoryStream.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.909892409390874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D74405753F829E75E89BBA5EBC296112
                                              SHA1:474944856DB781A34796BFCCE18ECD4580275AD1
                                              SHA-256:86F1F12E47F260985B08BB966598123578EB5E48BEF9BB086F04E16E9D53BB32
                                              SHA-512:CDC5D49FCF0249C539E45C9917C152F130C8FEE975D97C2F62526F474CB779B2BF273195F4AA7A64F76DD2496528C0D021B56E60AAE2635606F9F55092CB47F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1W....@.................................l(..O....@..P................>...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.IO.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21144
                                              Entropy (8bit):6.936275464847822
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:809FDBD7422A3E02C89244DC530A3367
                                              SHA1:A6999C04B243B034F8EE7AD0D79F3CE24DF9A9D0
                                              SHA-256:C191A43029EDD4EB8EEE003356F1FE79AA45071C25433A7A3589590E9089EED9
                                              SHA-512:5232B7EF2B60A99BE2B027112078A7DEBF58BFA4308F4AE53DD9A96FA7BCCBB0927BEB7148E7A3944173F7820F9F519767539D1FDFEF848B6F1D6668BE11FC15
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................A.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Expressions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.8873536206529895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B49BF361F3116DE28176B40845BC199
                                              SHA1:5627E53D15E56868DC9082EDCAE5A653B96B9AF1
                                              SHA-256:BF97F67165231C2A42B95F11D80337B082E2B2BE54351DA44C8A10C06194B369
                                              SHA-512:0FE87438ACD6C14401523987BE617A83DDFD2B42938FC52E0DA5F941F7DC70686CC6436EDD41C4998FD56D5F52D64ACFAB5010B96B1E80C084C4AB9F546202A8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ....................................@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Parallel.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.913851684806603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8BE0CAA60074176FA1E7E63C0AEB6C01
                                              SHA1:4D4AE0D2664025327F28400D917CC59AFD69F33A
                                              SHA-256:30A49D16436E3A05569C99A0C2D21755C2FA323C5B925F9F21C10287CC97D9C9
                                              SHA-512:057F21A7E7496343C06CC497A24E46E59218EAE1838885EEEF7391285CDE243AFE853155F52933959B40F40AA7028A289D15D279833208BBA42BF853D4DF91C6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................S.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.Queryable.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.914858816124373
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E04CDB6229D83768285ACB08D870F23A
                                              SHA1:A181F5CC93E9273D9169A9954A74D73BC1852980
                                              SHA-256:719AC73BB261E0A13574F5A198126CCF40352264958DEFB555280D005134C704
                                              SHA-512:257FB07C0D86E292FE6FA88E03B29994CB9864C17A535CE7B366A728EAA4B3A803D88A23157CAA457D0B681A2C0D97DD7D9A2754300B73030D9A09C4E9004772
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................F....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Linq.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21152
                                              Entropy (8bit):6.8927140284137165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E33930FE2E0867CB1F9FABEDDFBD7B1
                                              SHA1:4D93C7D7E6315CA2195ED73716996ADE8E17FBB2
                                              SHA-256:349C7FBE9AE2B78C2F90239BDDFCEA5B16A0FAAC1FE83553A816C50C3E9089B1
                                              SHA-512:8F87B5013E0CF3A776BFB1F1A68F316A28AF3CB6C74F0ADF3EAD6D5063525C6668B42C077549F66267130959A9CB986BF5F8E4242FC4EF36C356D6927F587A0F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................~.....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Http.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):198472
                                              Entropy (8bit):6.150725701658664
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:665E355CBED5FE5F7BEBC3CB23E68649
                                              SHA1:1C2CEFAFBA48BA7AAAB746F660DEBD34F2F4B14C
                                              SHA-256:B5D20736F84F335EF4C918A5BA41C3A0D7189397C71B166CCC6C342427A94ECE
                                              SHA-512:5300D39365E84A67010AE4C282D7E05172563119AFB84DC1B0610217683C7D110803AEF02945034A939262F6A7ECF629B52C0E93C1CD63D52CA7A3B3E607BB7D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ............@.....................................O.......h...............H?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1...*.0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2*..J.Xo3.....J.Xo3...(...... ........J.XT.*...J...XT.o3...*..o2....Y./..*..o3....%3 ...Xo3......Xo3...(.... .......*.*..0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._..*....0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NameResolution.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.9009750652396775
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2EEC710DBAACD32BEDFCA09ECA8DE52D
                                              SHA1:2CB934305D3648FF29FDBC7D92485003F8458848
                                              SHA-256:222BD77C5692C2961E8C3638F6511D6F7CBEB9E0977E2D5C3BCA6739A5311F37
                                              SHA-512:03F132E1BAC629A394A093D59550B22D5FD4C4D6F244697173229282741A9CD6669C4256C024467CE94293C74F304560066711C35620AB4750621502AA67B5B1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................f.....@.................................T(..O....@.. ................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.NetworkInformation.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22248
                                              Entropy (8bit):6.861480146265617
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F39A35095CFD0019D6D4BB8461750BF0
                                              SHA1:AD55AF22E5479A5ADDF01D698138E5149270E3CF
                                              SHA-256:2E2D28A0802D8C8C08C0D422F48733AD8BF1DFAE75F5682A4A3DF8898E7E819F
                                              SHA-512:25FC9D4254DE0AFAB9AE3E19B8B225E1D875DCACE6CA2C83F768B62C0E2B331CC9DD2988DFF7994B5819FB0DD7A89A49FD19E653FC2E4EE656182E08A969A93D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Ping.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.898664332146086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2A459C2C395F54352A16DE4AA0E5407F
                                              SHA1:1BA9ECC598E170D779CEB290163AC88E6993935F
                                              SHA-256:4D97E8481B9A27042BB903245625735D82FF627C66797DE619303C1E705D0D6A
                                              SHA-512:28DCB8B6E306015D2004EC00443652CE986AB8E09FB09EB82193BFB0604268CA63C527FF64B6364F63C3ADBCDAF5FCDF4D1494243BFC8F6BB629BD213073BD7C
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................|.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22216
                                              Entropy (8bit):6.840714789582829
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:562F67001889CDBC2531947636418EE5
                                              SHA1:B219DD45550762B54DAB46533D489C4755F55E0E
                                              SHA-256:9A8BA725F8E953C933285065228A9409036F9137D03016B127CCEA8A19452466
                                              SHA-512:FDE868018D24FD72177EDE58952325B52561F9D44AE02A4A2268E445F47ABF3B81B809F443D362DF83BD6667B5988AC2CA15242B9F76A0B5FB5B444FADA1BF26
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................0c....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l.......#~..|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Requests.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21184
                                              Entropy (8bit):6.933179959460408
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28141960A88365DF6A60B0C6FF831B0B
                                              SHA1:B56C3D2E270B1C793A2EE17CAC9C98B178258E94
                                              SHA-256:F2E74A3EC2DC753C9A48FA9A677775F949EB1E02FC1BB8BF38C39E8D2AB147EB
                                              SHA-512:CD44E789A6C04E2BC3B07810B57CC83787F06530065FDCE069D89E42557F40770923CC705E73B7699731166F19FD7133FBDD8EDD578D308A4F72CBB29E76939F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................d.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Security.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.870719034523618
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D00682E84D1D773D2160B63C0380BA6
                                              SHA1:5E4158533532A27E03D0CCC9A0AF5E89FFFD8637
                                              SHA-256:D0D90152136A0ACF340FB345098F2E5C718BB13F3B5A809D7BE4D9948B8574D4
                                              SHA-512:991FC952B452446255963AEB4F11C74E7116E15B666924452F3C0D15517322EF1D925DC44BC1F003E8483B5C0B34AD71D54ECAEE360FD9E942664FDEC4E37E99
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~*... ...@....... ..............................X~....@.................................,*..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.Sockets.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):30544
                                              Entropy (8bit):6.684598614993447
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9D9F45B85526E491F6555B1566A41C
                                              SHA1:1420EF91F6E0F6954F373F1AC4079064398AB455
                                              SHA-256:694F4C61B6BAE0AEFAC07A1E861C12C03CB6002F30091E4C8B05BB9C8CCF0D3D
                                              SHA-512:38890886C641D7E6E76A3D4D984215C680F5DCF12129BA2EBD560644EDA793335B01C637C1F6744C249DAB1FEFD5AEB8D1B212475221C03DF3CA82413F6670C0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..*...........I... ...`....... ...............................[....@.................................gI..O....`...............8..P?...........H............................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o....*...0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+*..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..L.......(....~....%-.&~..........s....%.....~....%-.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebHeaderCollection.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.910950453979084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA1FEE108A0750F47B70F25FE2CC55A
                                              SHA1:6523838EF4AAB39D0D3C0DF11C28ADA449EDD592
                                              SHA-256:69B48FF8E6F40B84CDDDB95BCDBB34E1184A2E29CB4CCC0FC9F1A2493648EE37
                                              SHA-512:9C0E69C07B2ED6CAA9BB3FFD9EBA6C82A0B763F2DFB06341F6343C54DBC254505CC0350B96B79DC4062D8D28D47C79824E98BB293C8C85203E827164AF862B5A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.Client.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.91070814532456
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E06BAE626965FBDB0BAE5437498B5155
                                              SHA1:49392F58BE6F5C97C5DE59BFC44F9CFCBE1E5DD7
                                              SHA-256:19766A20B62B038ABC3E863F2D6E7B55FABEE4D9CBCAD3EB1D7BD3EBFE8D023A
                                              SHA-512:69C6D8D5F8835DA31D36940F0AE793BD00D87E9CB9380C3A7B21FE3E315F192F95B8E63C8F9D0A3737C73673A0AEAC41FC728FB7B236F12453A953066F9E53E7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................|(..O....@..@................>...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Net.WebSockets.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.92602478259668
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E6378FEAEEE2F745417FC025C7850F9
                                              SHA1:E0FAD5EF75676B2ED7CF155AF6602B867FCED041
                                              SHA-256:99920CE34A01A0C07EFD86D6E134BB401993515D001B7567A4116AD222993A63
                                              SHA-512:5A8C41F32598BCF8C8E315B18AD5F1BBC377D7B638DC05CAA3CC47E988536AA0EBE4718D73AEE39ED5004328BE3A9DE9722D8759E5DFD500038E7139DADF9638
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ObjectModel.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.907185647363724
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55D9528D161567A19DBB71244B3AE3CE
                                              SHA1:8A2FB74CF11719708774FC378D8B5BFCC541C986
                                              SHA-256:870EE1141CB61ABFCE44507E39BFDD734F2335E34D89ECFFFB13838195A6B936
                                              SHA-512:5338B067297B8CB157C5389D79D0440A6492841C85794EA15B805B5F71CFED445EFA9099C95E5BDEF8CF3902A6B10F032BFC356B0598DDE4F89FA5B349737907
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................L....@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Extensions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.911906528800318
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DEFAADD4A92D4D348B0827AB8159D2FE
                                              SHA1:F3BD9B4108ACD42ABFB99A3A4760BFFCB84F6C28
                                              SHA-256:3D2551D6458B84566025FDDFE5DAD479CAB5785428EFD6814860D36AD1811C9A
                                              SHA-512:1B13C70F05D56871008D5C8752BC93C8FB590D5F89B4E97264F592CDFD772CBBCCE8380D255F8BB305BC25BCDDEA21E422617FA614DFFD3DDCC9A1D4BE6C54A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.863412750707488
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF318475E6A7A56789ABB0F98C37ABE1
                                              SHA1:33D1EBD7212D747C8723CFB9E4292C99A641B964
                                              SHA-256:0383DC02FDF0B5D4612D8CAAAD13D594CAC1609C8240B73DFD6EA5803F5E17EA
                                              SHA-512:5C67456A65FD051147281E14041F5165C1852FD6519DFC8DFCF9C86F20217CDAD9E2D26F815B557B99E2DB3500AF47B2DF8A1225A659FA1069815CD62302458F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N*... ...@....... ....................................@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0*......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Reflection.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22200
                                              Entropy (8bit):6.818690002285853
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A3DA139180E9FAB380033D8D1FE3995
                                              SHA1:3CA31DE7F0F0784559E5A73EBD0EFB42C34D18FC
                                              SHA-256:63AAF632EE7F3BC852C4D71C742CF1D26F18F784F6C89113E056B2599BA8F514
                                              SHA-512:D991298419FB5290D6906A1F9FCCEF56BB3E17506E235C85B4D979EBC49ABD4F4B3123697E675346B57829C3EFDEED6291A155D69348CD55B8B6B2EEC9F804A1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................Z4....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Reader.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897645601910542
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F1CC91D25B52C7504DC5BEAB5D0F498C
                                              SHA1:498F0FBBD2712F4F637BDB7370B2302FCC4966F3
                                              SHA-256:E3036362506D96C9C00ED6393A2AFCACD9F2E71CD2A35C1D638A61E85D2FB040
                                              SHA-512:4C931389035DF21AE67810D8C8E95CB613D9495E2392B11E34D84F624F90C78C541B14FB0D6FE7F0F89799AAD4B34E91FB6F73978AE38231840F047915E6EB5B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................q....@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.ResourceManager.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.926543977764199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9E71DFCE86F14BEEB8F3E9F00D0A472E
                                              SHA1:BF83A7E98418BDE907DEAE8C0C0F3FB0F6C9DB1A
                                              SHA-256:62DCE4679E33C079E11F41B096BC803B30B1D963A1EA79EFA84187CEBBC06AFE
                                              SHA-512:FF8CDC0287E510F859F46C1E35F9B0FB42EAD907B1EAA42C90C84B31CF6C2D4638CF682777F359B8611DD22062C1A5FA71F7FB667B7A3903783673E678098515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Resources.Writer.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.904224159979604
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05D1B950C470EA8B0AA357F9A59CF264
                                              SHA1:B1756DC750ED5CFD5D0BFC70CB899FD590867A0C
                                              SHA-256:DAAABD07F1B94BE19D72913360286E469F454886850AFCC603506EAAB03150E4
                                              SHA-512:8E65FF1909AC8D65F599062E61AC935A919D43404C357DBC6AD628923B0C7ED7158862DDD272CFC1C2A8CEC393D48A57BC4D69CE7706EEF1BB6838826B1AFAE3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.Unsafe.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):18024
                                              Entropy (8bit):6.343772893394079
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C610E828B54001574D86DD2ED730E392
                                              SHA1:180A7BAAFBC820A838BBACA434032D9D33CCEEBE
                                              SHA-256:37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
                                              SHA-512:441610D2B9F841D25494D7C82222D07E1D443B0DA07F0CF735C25EC82F6CCE99A3F3236872AEC38CC4DF779E615D22469666066CCEFED7FE75982EEFADA46396
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."..h$...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v*...#.;.-.h.......0..#.....a5|T%W...].!.%'..9.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.CompilerServices.VisualC.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.872325269765102
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9F31B6954FD453F13B5F39DA36F2E8EB
                                              SHA1:7A6276348D85EAF00AE6958117797045929078CB
                                              SHA-256:18A610B8BAD43CF784CDE4D4902A238F2281C2A677DAAE790CAB55F6DA915979
                                              SHA-512:D3696D4D60CFC5AA5834F60A0B97A4F3A3F8EC3FB05BEB3C3D927426B72B3E5463C628C7DF950E43FF1344823B8C2D39730BA47BA0F2FEC7A0CFCDC237A5BCC6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j*... ...@....... ...............................R....@..................................*..O....@...................?...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Extensions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21720
                                              Entropy (8bit):6.851248273705748
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0346A4C5FA0FAC135509A0E7D3C4449
                                              SHA1:7D71B46BB9A28289384AA1EDF5CB03D64B3BCFF0
                                              SHA-256:F9FEB277F86241F55425182A26DECF50A210675D4F040EC542AF3FB3DD287DE6
                                              SHA-512:916A465236F11FF6E421800961B20CB80A320176DA8C58002F6742040CE33C5207D378667A584C5D8E35CF8CFC19AC54504B3F6129E489EEABD86A5B4E7D8C77
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............*... ...@....... ...............................Y....@..................................)..O....@.. ................>...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................|.....|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Handles.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.924980445039345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65FBBA7A86B3E175200AE44727AB40E5
                                              SHA1:584B8683943A8E0AE98B10F452C94F6109D1C4EA
                                              SHA-256:7A81D2A001B543B2A55C9AFFC845A5DF7EDAB1FD308C6979BBD982B1B826B57C
                                              SHA-512:43607AEBBB0A3F2D437C7DE77785CD6C9F49411E1D4EFE41ECCD93D7FCCA197DABD4E15F45FBC4FBFF27C202FEC96B79F82202AFC88B59C20ED5E7912BCDC6D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...............................d....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..................................................*.....*...c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.RuntimeInformation.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):28624
                                              Entropy (8bit):6.700175270481286
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:568B53398BFC0E54AAF448B68F5C77C2
                                              SHA1:76B0B6E65E38A90A4ECDB3F6DFE16D5A803081E9
                                              SHA-256:8BB9D52BA5C67F05C8F632DEB1E7E98A909318B10E1388B47E919515FDD42CBF
                                              SHA-512:6052EE3664FD2095DE3338CF6D24DF022DC13D00B4BF14C57572F2A34AC078E07BD1F634A50028DB0952AE8067FFCF19079177FA534240D9526F33AE1E1459AC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ...............................V....@.................................PE..O....`..x............0...?...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r/..p.(....*......(....*2(.....(....*^~....-.(.........~....*.0..........~..........(.........(....-Y..(!....{/......5..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.InteropServices.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24296
                                              Entropy (8bit):6.780229572480669
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7E74EA95786A02687CE43C356ABDC95
                                              SHA1:2E6A3047BD3BCEE01F55D139A3C03E6D4D2DB14A
                                              SHA-256:383A1F9DAC655C6805C24D4A03BC5FBEB9ABD1536DE5510F5756259EEFCB4871
                                              SHA-512:B7E76B65406904F092FE96DED558A94EA53FA40BEC500EFCDCDEBF124921F4526DE2F239CD25BAE1801692DD6DFE5652FFD46B2AA4325133C7127D27F626BB9B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................k....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Numerics.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.898006718463938
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6CCCA0BA6A7B9CAF8B8D3B0287DBED8B
                                              SHA1:B81FF87B407578EFBF184BDC10D0F101610379DB
                                              SHA-256:16E7EFD6C19B2E3E516AE1BC7B3175D0E22F1AD357701F229E353DA348EEE182
                                              SHA-512:8505479031A0A5CAEEEE1A8A60AA35D7E0C332BBFDDE61193B615E242C127780E55F404289F26930E9EC9E53FCCF436B1A991BA2C8A9177163B41AAAF6BE0D32
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Formatters.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21264
                                              Entropy (8bit):6.950539566613158
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A42C32F4E98A9656FC2FED72D30E9380
                                              SHA1:B6B8986FC1B5140817DE262AE4102499E37DAFFD
                                              SHA-256:C343F7BF08A4C97A90BA607A492C721533333173FA63F65F6E5DE9CEEE65FC16
                                              SHA-512:5C2DE8F18CB9B367D7DE88A2AF8A7FD538486B9FFB393972FBDFF42CD2899D6679FD8D7076FE37954D5E8EAB6C5041F19EDAD32659C5CCEEC1C2BA35E6F8982A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................|)..O....@...................?...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Json.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.93694523950017
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E2239979B853157BA75310FEA7E65D
                                              SHA1:EE1AE416570911282ABDD3745674E58F9D469C9E
                                              SHA-256:E8D531F0AAA674F794B7F43EC76E4E32AD93F3C136020CF4B6E3433832F9C0DF
                                              SHA-512:DDF9D6E05D9566C9E02295A061756FF164C408EA211D016023EDBFA91BBA4D0D7DFF293D2BF4D87C25FE923500C7535E4A21B6A8D4B18FD9505F8E5C635F9C95
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................#....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27048
                                              Entropy (8bit):6.661112158879877
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3373A24450373CAF0CBB756E10097FD4
                                              SHA1:87C352153804FF5BD4F8AEF8851546F3CF22461E
                                              SHA-256:575E26A455892F1FD77B730E6928F70B760E76094AFE5BCB677D854DAF869AC5
                                              SHA-512:85E005B5BEB7C14BA34C62C38DA635962D1AA4740F91549B8659910EDD10F0FDE1734064B19567BF5BC63DBBBB62399F6CBE0AA323193DA599232DCE22B14A01
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................Ag....@..................................8..O....@..8............*...?...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......|!..l............1..p...X7......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.Serialization.Xml.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24816
                                              Entropy (8bit):6.774158289322937
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9087373EEE85190DAF8915E614B1E4BD
                                              SHA1:F434AF8CE30EAF5511E28C0230211F0D8ED4A154
                                              SHA-256:557858E44A51A74646AD07A85CBA56AF1DA13AD26AC2F74EE5D8C3E8A171C221
                                              SHA-512:F728238FA567457D7977FEA667FCCB56C2EFE718A9A362E294934CC752E506E05C5D20C0BE2A309DE2A984DD60C3AE4EA03054185B96C9B5F5F5DE827AF9CEAF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................6~....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s....*..s....*..0...........o....u......,..o....*.*.0..%........s..........(....r...p.$o......o....*:.(......}....*..{....*.(....z.(....z6.{.....o....*:.{......o....*.(....z:.{......o....*.(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Runtime.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):29360
                                              Entropy (8bit):6.504362287456874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0E35085C130D2D91E5241334BE7EF0DA
                                              SHA1:FD622ADE5CAE26353A22B6FA50A83669B72B6C41
                                              SHA-256:50AD612D4CF6113DE26B2870DA099C4817F59E64A2DA98F05803B4A2E2304919
                                              SHA-512:2498811F4AAC308CDC55C3406BEA4FEF5DC9E6F23559B09FB181F7447474EF586F00038282DDC39C241490B5DC2BCA7F41F19BD3E1BB00890DA29DF6489BB151
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..*.........."H... ...`....... ..............................7.....@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8...*.8.....8.....8.....8.....8.....8.........*.8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Claims.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.921540746927502
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99604779C668D9B8EF913854B9A24F9D
                                              SHA1:97B62A3DBE2465B4C995E082AD6FF183F6267F59
                                              SHA-256:8270D1248950EE8AEE5C2AC2E321DF07E65C7A94004AE03C857DEACD231A5542
                                              SHA-512:BE6DEE6E7030B400EAC68AC289EC9B74BFE0140EE59AF5E68BF43A63A821C6F6AD9CA03C501896A6C92464BF8116D7996FFE640AB51BD9FA96673D9794AC82CD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Algorithms.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):47016
                                              Entropy (8bit):6.126380612996906
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E4A1681E09AEC6EFB00FB2A9355A1296
                                              SHA1:95699D187BF150D319CC64F90064301CAC57F338
                                              SHA-256:967DDDBFE7F1CEB933B5875D65C59CDB835BB063F287A361E8B35DD814A9B14D
                                              SHA-512:49299C773A4C7CCC235C54A91FD07A000CF547B3EE55272E2EE8B2AA40281DC0AF3C3B5A9EDF5CAEE4BEB3AD0DE5A0DEA07159ACEBA582911B78A6B85DB793B0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ..............................I.....@.................................u...O.......8............x...?........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rI..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r9..p.(....*2rm..p.(....*2r...p.(....*2r...p.(....*2r=..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Csp.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.935501042478791
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F554762FC38F81CB22D1DC8AB5CD40D5
                                              SHA1:A67FDACEB10E828805A9E24FE0C59E1D73D19A7C
                                              SHA-256:566775F5502C3C1FA70ACADE145293DF5D02C1A9F031820D429605E9B4584B44
                                              SHA-512:BD23571BF9D0FE62BBF5FDDCAFF6B8F383CCC728AFBCEEBCAD8404D68C02EA1F55D4A22306BFC86C30172E70C6CF5425F2FF8877AAA8758A51C48CF4303BD2AB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Encoding.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21256
                                              Entropy (8bit):6.945812678642078
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7AB10B31C5CE290672B319D403751E95
                                              SHA1:ED23E654968B3704A82F613B06BE5829E0CAAD70
                                              SHA-256:1F5C1ABE1B2720680170388569354D8CDA9D558B53AFF7CAF175CE0F7E3733E5
                                              SHA-512:65ED3AFF2424E7560FCC44380DC719BF200D444F9B06AF7F916D52152C330D55A7F4B96D0C1D2B291B07D82805C71DD9850F2F5F612F00ADFCA1CDF117C6B14A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.Primitives.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.863777213641518
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A60084F9988C7907F7092C143C8D3818
                                              SHA1:A69238054BEE26063D32B85B797BC4E0C49F79D4
                                              SHA-256:B755D0B55A465D07C9DD3FC11822487D1E649B684AEF91A4CE9B935B416A01B9
                                              SHA-512:6147F18BD9C49727251CBEA7A3168E3B19F34056DE5A9898571ECDEC85D424627A72968072449C81F97F95330BAED7E2ED0F6FDBA7E2F79B59B9352AB11003CF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Cryptography.X509Certificates.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22832
                                              Entropy (8bit):6.823696761227228
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:06D000552ED6785988AE188FC35D1B86
                                              SHA1:B0A8868D459FE0AF34D16C263CFE0202C414DC53
                                              SHA-256:3C8630ACB43C12A6A317227FF2922056ECD991FE945464FDF7EA81F1293A479F
                                              SHA-512:F3E5E97AAF3D26EA62C64787198CCE6DF703EA3A4EBB389BEBC84B424C8129A0181142A4FA5D965CA3106758A047D0E1A723F181AD293FD389C4F1B8D290B5A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................j.....@..................................-..O....@..................0?...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......|...#Strings....x.......#US.|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.Principal.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.913262967781329
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6DCD91B6A029794728F4EDEB2BF2E42D
                                              SHA1:82BA1313448B431893C14D866F46D47B620514A9
                                              SHA-256:02416BC542BE82002B8B81ADBBBCDCC8D098104020D09B571DC674B5BC19A177
                                              SHA-512:2566F369EDEE9313E823AA2667CB95977F0DB57B4B47DA62F44850811F524D0598FDE6F5BB082BB3325789E4B256E970603B4297D3586F1C435498430723A38B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................s....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Security.SecureString.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22392
                                              Entropy (8bit):6.85070945929809
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4523F60270149BAD67F6AE63375D2CDB
                                              SHA1:FF6E6BCD83A11D40BF53DABD0480A67AECFDCF50
                                              SHA-256:18032D190D0D599823E59C8DD8B588909BEF8888B8BF304723A138B61F1B911F
                                              SHA-512:025E33F6927E634FE187491F40D96B36B2DDAF2ACDE97B340C8705BAE58BDED6C02B8BF9199A1B9D4AC75884C69DC665DC03B34571B1BD178CA1784C5F0D5451
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................#.....@.................................>)..O....@..................x?...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(....*..(....*..(....*..(....*BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.Extensions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.925439366434707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D40515A84448B91315F956E6D1A6C64B
                                              SHA1:7FE773332D0461A252E52BE720A7794FCAAC7BFB
                                              SHA-256:CBE29672CD2B6A0EA97B55F3844FBEDE3E591996F39C3AA1F829F2FA50551FA9
                                              SHA-512:322F82AEB9EB9DA22257AC9FE835BF1C54C1BB268D37F0F97A4CA52BB42F6ACCCA9C8DBDB96D6D695FA69C24F5069978A4B6F1E960EE81D9EA671CCD30A348D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................iR....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.Encoding.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.85763123423511
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7F65CCBF58C39F3853BB8DC4137DFD12
                                              SHA1:3946DFF0B68F0CA01689BD44C348559ADF548258
                                              SHA-256:0AB1F7F87B7C2AFCA57D394E4F4E262C82BA3209CB0A750CD66401FB33F21ECA
                                              SHA-512:FF7D953EC4B82C10E64FC85D3AFC8A1A58582170EF1752D4688FA1D48EFC490DBA5F0A784E748F7902E96FD885EA868B1A84DE44F48CF071975F3CD3F8E52C6A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2*... ...@....... ..............................'.....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Text.RegularExpressions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.952743264834991
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7D317D88F9860A18ECF7FB90B33995D3
                                              SHA1:C2E4B19CB9A0B48E899512CD121FFE6657D41072
                                              SHA-256:C98A52BD017DF01AEA7B955E6F219537D391A62C2C2B976684DA282F9CD7CACF
                                              SHA-512:79ED01C6D1CEA3DBA6B3566E03D05A971745E221BE9330F6800A249D1B239E092D3FF704E7403E7ECD6B7709B24B0CDD7E518F2EE5DA38019E7139D80594173E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................Y....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Overlapped.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):37752
                                              Entropy (8bit):6.646566139863202
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A890C488CF2ECD406B804E7E3C5B7F0
                                              SHA1:BF2C1287F0EC04223CD17FE20AB2ECFFF18579E3
                                              SHA-256:F17FF442B77A6CFE9C118D2F8FAE1AB6C814A0D4F35C5844996BE84F3FCC8592
                                              SHA-512:4EEC61F9245DFF3D468818D6D6CBB8E12A5172658F1027A9AB0ECE03CC1377499833056A0DD4FF20B83B9FF9E47BB2E7F8DC7B641BC63AD78FF96C54BE01F524
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T..x?...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rK..p.(....*2ry..p.(....*2r...p.(....*2r...p.(....*2rc..p.(....*......(....*..0..;........|....(......./......(....o....s

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Extensions.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25984
                                              Entropy (8bit):6.291520154015514
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                              SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                              SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                              SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.Parallel.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.924199325151996
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9088029E38B2A393F22AFD9E576CE86E
                                              SHA1:05E65EE95F647F38C717C73A0399870912DD374A
                                              SHA-256:3468E0C875DB94A8F45D56AB76BBCC677B942CA51A23649BA3C5AD1B20E391F1
                                              SHA-512:23DCF5819996EE0F0C8FE044D6642A12E98A40309CE1F3F74688CF8E3DD6F6ED230AEC391FE7E511E15FBBBF14BFF09F976E923F22F2D68AD816D8FFAD17F101
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................d.....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Tasks.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.854915516686979
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0AD301EE2B7282B87DCD0D862EFE14DC
                                              SHA1:F720109A38846E358BDE7C47D9C946A79D2B6B1C
                                              SHA-256:0110616DFE870B8BCF25DF8F6CE38EF5AAC39E728DDAA3420EA199F5A7E80A16
                                              SHA-512:C66FC92435C399804D8A8C1C836E5648725DDA8A55D7ACD897AE719CA231D89251A0D9A293A67F079E345709CFDA83DCC693AD41A28D13661A55459F94FE33E0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................k.....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Thread.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.917303618941186
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FDB3A743B2DAE5924CBA88A5C865128D
                                              SHA1:C53132EC95A7211C1BB6DCD5AD21CCB150A7B923
                                              SHA-256:9D4FAEA9892D4ECFABF61986687FC6CB30F5F51A6B62819B9571FF58E04C4DD5
                                              SHA-512:CBD8370F3CB84CB9EB8BF3A7392245D6A90CE1A324971EA96170974DA092BDFC3DB2196F66958CA5D5000F13B18AFAB44FF82D50C5B9A625AA1B7A4AF17717DE
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.ThreadPool.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.913880291057063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:18CE4ECC42FC8D999EF091D812472CF0
                                              SHA1:F874903CEA9F08F1A0887949B47722E6BA81B789
                                              SHA-256:3D9EBC81B1BD3234666C8CE403A5F17A726867C68FFA5DE4EC8EE92599335658
                                              SHA-512:0C027440EF6F6C105B0BF9319F4E0EA421FD310699028AF0A159300145C662E74B4B5D969663E3B52CDA7F9934A6AB93BBAE9BCD1BD39AAAC24FCBA7EC451156
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................L.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.Timer.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897588144752097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:824053272B268C577E9ADF17ED398142
                                              SHA1:5EA3F290ECDE1BAB983CEEE2417A688B7ED9B7F5
                                              SHA-256:04B9235F64C9C846F8A767230714895DA87C7AE2CD0105E9D14835AE46F0FED8
                                              SHA-512:F475DCD2CC23FDFB017688713170FCAF8FEA05869A680613EA4AD84CB358ED0F2442DB0FF0DCBD739E3CC3DB7128A8F4A568AE8E5AF6A8840319B02630E420B9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Threading.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22192
                                              Entropy (8bit):6.821272653310105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11D674CFC81B7102C0BC6FFE58F6AC5E
                                              SHA1:DDDA49572D112944EC9AB62B31959AA93A386618
                                              SHA-256:4DC8D588EC63641C28422D648E8DE5E2C030EB7AFEC2071A99DD3BD9A204557F
                                              SHA-512:FB7C628B796A321AD9ECBF01D165E24F151C99D7E60A65D0AF52F779AD60A3203F47B247D44FC47044A68790D1EA4EE458A7BC8DF7EBE9D42C2275A9C11BC324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................).....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................*......................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.ValueTuple.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):78992
                                              Entropy (8bit):6.056589052139225
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9424E37A28DB7D70E7D52F0DF33CF8
                                              SHA1:81CD1ACB53D493C54C8D56F379D790A901A355AC
                                              SHA-256:E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
                                              SHA-512:CB6364C136F9D07191CF89EA2D3B89E08DB0CD5911BF835C32AE81E4D51E0789DDC92D47E80B7FF7E24985890ED29A00B0A391834B43CF11DB303CD980D834F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................>...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........*f..o...........o.........*...o...........o...........o.........*...o...........o ..........o!...........o"........*...o#..........o$..........o%...........o&...........o'........*....0..L.........o(..........o)..........o*...........o+...........o,...........o-........*.0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... ...*....0..k.........o5....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.ReaderWriter.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.911176710124494
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:090FF56C4FE2EEFF2E16F03099AD71E1
                                              SHA1:EF317CACC230A58A3B2FCC6CC079CC763AFCC7C5
                                              SHA-256:5F560E1DD529BB2529D7052E04008449F58D0439C2BB43437D7B5D39F84F949F
                                              SHA-512:FDAC43D0A18D9158DB4438349A7A550557A36E6ED0665EFCB65A046A5BEB5C38181996CBF6D860B8AD01C19E35315BB61AE766CAF06B23985E046484DAB45256
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................W.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XDocument.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.875690583921479
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37E21B63959F243A157534133F85C5AF
                                              SHA1:DFAD52A9990B2FAFCE7098CEBB174927E8E0BA00
                                              SHA-256:4F6A14E4BA2A2B26B8B8433D5F82F75A96AF5A4F036D9447373B07271493917B
                                              SHA-512:F59FAA6319FE2AFEBCCBD643E20C1EDB75DB74E9271354BD86DAC3BEA2CC59452EE024DC26B517AE88254A7C90DBE0E6C19A7B5AB3BFE9159D986D6C53CA5521
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............*... ...@....... ..............................#F....@.................................|*..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.XDocument.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22904
                                              Entropy (8bit):6.8552351968066105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A5F541655A9EDC24F4B5184A40E40227
                                              SHA1:90E196DCD76168F770ABE30098399BC5866ADF1B
                                              SHA-256:B33D08149A756A401628D11BFDDFEEACA1F03C0578395BB061DAE44F8A12CE5D
                                              SHA-512:C4D13E95114E232300B36ED7B7A72CE786F66D0F68B0ED9D54FEF788A831B39C893DAA3C2DE982B376A56A539C23E8F314CE8552ED7094E6826D5F70BFBE2D4B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ...............................+....@.................................z+..O....@..x...............x?...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P*........................................s....*:.(......}....*2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XPath.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.950543834803339
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:415E3AB72F17F10D646B3E2C7A76F612
                                              SHA1:ED25E94D4E88293345A0F28A5B975159C393B050
                                              SHA-256:24DAA1FAEE0478BA58FEBE8EE789EB88BE0A14D350B57AD8B10690C55976B2E1
                                              SHA-512:55B5C22B87F21DF89D0514AE05C9433B65A3C7532845FDFC4C2C5C5E2C3929D70143D84698FDB4DC13EC01895B1022CF0E5E76E12102739530B54150932A7B07
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................x.....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlDocument.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.8884260737638385
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:328D12AF9613B0F3F25320B85DCCCBF4
                                              SHA1:09D02B85A094E925AC3C5D8B1ACA096B730C160F
                                              SHA-256:8957F0BCEA6AB8A011A53AE62466505199F11A228F87F3809931D974F87078CE
                                              SHA-512:16569ECB727ADA36811E72FFC925F07AA21B8A627BE45F1EDA18CF2B759939591DCAFCB2D087596EE903C5ABFFAF19F56F25E9710EF22874C934CAD19537B798
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............*... ...@....... ..............................\.....@..................................*..O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\System.Xml.XmlSerializer.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.916807633540711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D9F02D9F7DA653F82E75112A2AB99CE6
                                              SHA1:BBBB4C2C3911AE1F5BA7FAF1D632ED0F14D9B6AC
                                              SHA-256:21493F7F615A099E795F7FAE7ECCE6082414D1D427790BDF4B103623A3AB34EB
                                              SHA-512:DE5546FF103CCC6AA38E254039A372697A193F9C44D0A44F0BE3B242D9EEF63023DC3FD0C6E8E0D2363177F9230A4E7200D4C32591B398269A1CEE9BC47A99FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\Networking.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.658759389778389
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDBAD5CCE582E8C56A25F0B64B44D900
                                              SHA1:5464F69931EB97E468EC310A61521AAE9AFA9054
                                              SHA-256:3E0A9CB4B739A4555DCF8915D1CD3D9821A2E1C8ADAAA98D3917B6E38F963547
                                              SHA-512:9CB9F28C320D8FF240E29F2D87077EA3AEAB830C6596DC7F20DE357EF3625621F50694B958682D5B2AA24D7843486D66F769F1C12224F36634BBEF33388C49A9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.e...........!.....z............... ........... ....................................@.........................(...(...<...O............................... .................................................... ............... ..H............text....x... ...z.................. ..`.sdata..x............~..............@....rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Uninst\is-K585J.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.658759389778389
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDBAD5CCE582E8C56A25F0B64B44D900
                                              SHA1:5464F69931EB97E468EC310A61521AAE9AFA9054
                                              SHA-256:3E0A9CB4B739A4555DCF8915D1CD3D9821A2E1C8ADAAA98D3917B6E38F963547
                                              SHA-512:9CB9F28C320D8FF240E29F2D87077EA3AEAB830C6596DC7F20DE357EF3625621F50694B958682D5B2AA24D7843486D66F769F1C12224F36634BBEF33388C49A9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.e...........!.....z............... ........... ....................................@.........................(...(...<...O............................... .................................................... ............... ..H............text....x... ...z.................. ..`.sdata..x............~..............@....rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfAppBar.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):15872
                                              Entropy (8bit):5.392167003572151
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65A2CDAA1A7B477269B24B128C6E7CEA
                                              SHA1:3A154ED01006332F3A7A80DC45A323C7DEE10E48
                                              SHA-256:9B7D806282ABD8EFF2CAC6B12E097E57603AB0EDE82ED5752F2B01B17FBA6B07
                                              SHA-512:781D12BE7CD13FA90E9C685957782420F5D64B092B9115CC7E019AC670DAE12BF14421AA8F4DFB08D04E0A818A25C0091AC47CAC60DBB3EAFBA2D168C67E398B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.e.........." ..0..6..........^U... ...`....... ....................................`..................................U..O....`..x............................S............................................... ............... ..H............text...d5... ...6.................. ..`.rsrc...x....`.......8..............@..@.reloc...............<..............@..B................@U......H........+..((...........................................................0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..........r...p.....(.........(.................s....s....(.........r...p.....(.........(............s....s....(.........r#..p.....(.........(....#......i@............s...........s....s....(.........rK..p.0...(.........(......0...s....(.........~.........(......0...s....o....~.........(....#..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\WpfScreenHelper.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):17920
                                              Entropy (8bit):5.2867272535707315
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:24A725F929CEA66D043FA85A39228B67
                                              SHA1:2B874371B1705DB4434FCBFCA03F8AF57B36F2B5
                                              SHA-256:6E4B9D12FFA3AB66D6B913974F44A969031781FB82BB0921391A00C4D18F85AE
                                              SHA-512:654459CE76374C70017D51D1A1894D369EA9427B7700A91889C0989627056816926DB8F60B971DC4DE3BCDFC8BC09BA9E3615BDC1C9B8AE0BC495A47DF17B28E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0..<...........Z... ...`....... ....................................@..................................Y..O....`...............................X..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B.................Y......H........1..P'............................................................{....*..{....*..{....*..{....*..(......}......}......}.......}....*....0..q........u........d.,_(.....{.....{....o....,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o ...*.*.*....0..b....... F.5k )UU.Z(.....{....o!...X )UU.Z(.....{....o"...X )UU.Z(.....{....o#...X )UU.Z(.....{....o$...X*...0...........r...p......%..{.......%q.........-.&.+.......o%....%..{.......%q.........-.&.+.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\app_profile.json (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1091
                                              Entropy (8bit):5.422867818033837
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B7C72A299A37A2C1DFBA450EA4DA1C0
                                              SHA1:E1470C1F3DFA59BE0284703594116475FECC04F5
                                              SHA-256:BB9E8767511EE15BC7F10DEC46C127B486D3BBE4794298D7E259CE30F79EF790
                                              SHA-512:8B7AE4F307FD3D644F9364137C7358DFF156580B9483C67191E78627FF8CCAF27C6829D385D38647F853CC6E2CD6615887E4361B8A4299CF216848D899724E84
                                              Malicious:false
                                              Preview:{.. "ThankYouPageUrl": "https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid={guid}&ext.id={profile.BrandName}&ext.version={app.version}",.. "FirstRunUrl": "https://clearbar.app/rd2/?id=382844Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "ContentLinkUrl": "https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "UnInstallUrl": "https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "SearchUrl": "https://search.clearbar.app/crx/search.php?guid={guid}&q={searchTerms}",.. "HomePageUrl": "https://search.clearbar.app/crx/search.php?guid={guid}",.. "SuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}&output=json",.. "ChromiumSuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}",.. "BrandName": "ERS_ClearBar",.. "FeatureUrls": {.. "weather": "https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203061_{user.InstallTime|format_mmddyy}",.. "app-icon": "https://search.yahoo.com?fr=tightropetb&type=11745",.. "maps": "http

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\css\app.29e34c24.css (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\css\is-AHE4J.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\favicon.ico (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\arrow-left.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\arrow-right.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\back-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\back.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\breakfast.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\camera-light.14f45916.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\camera.cc7b8dcf.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\chicken.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\clipboard-light.1026c11e.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\clipboard.c4755019.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\close-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\close.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\dinner.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\ers-generic-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\files-light.675f9318.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\files.2205c6a9.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\google.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\healthy.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\apps-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\background-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\background.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\bookmark-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\bookmark.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\calculator-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\calculator.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\compress-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\compress-win11-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\compress-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\compress.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\doctopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\doctopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\doctopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\doctopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\exceltopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\exceltopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\exceltopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\exceltopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\file-explorer-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\file-explorer.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\home-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\incognito-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-0R5K4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-163O0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-16J2V.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-1AIOP.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-21JPS.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-2QM69.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-337TV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-38E01.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-3UOJ8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-54H94.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-5DNPF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-5MQQG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-60C4F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-65GDG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-6KCQO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-6V8G9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-81CAI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-9TBTO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-9VAV3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-ABC5U.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-AFD2L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-AFHUH.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-AJ9S0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-APGMR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-AVKHQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-BFOO5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-BG1CG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-BQC1S.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-BVI4O.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-D0FVC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-E0NIK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-E4OJU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-E7PVP.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-E9IR4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-G98FI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-GF8AV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-H44OV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-HKEK0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-IA66R.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-IH7H9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-IK7D7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-IT3A1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-JHJSB.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-JSRKL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-KJ9D1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-LSMVV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-MJORM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-MU0N9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-NI5AG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-OEF2I.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-PPAE1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-Q2BG1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-QH7F8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-QHPG9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-QTG1H.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-QVOGO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-RNR4K.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-S3TFQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-S935C.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-SNVTI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-T0UT0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-TQMGI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-TU7B4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-VC5L4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-VLL8N.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\is-VRASL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\jpgtopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\jpgtopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\jpgtopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\jpgtopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\linkout-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\linkout.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\menu-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\merge-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\merge-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\merge.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\mp10-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\mp10.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\newtab-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\newtab.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\notepad-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\notepad.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftodoc-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftodoc-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftodoc-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftodoc.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoexcel-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoexcel-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoexcel-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoexcel.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoppt-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoppt-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoppt-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\pdftoppt.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\ppttopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\ppttopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\ppttopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\ppttopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\print-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\recycle-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\recycle.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\search-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\search.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\snipping-tool-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\snipping-tool.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\speedtest-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\speedtest.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\splashed-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\icon\splashed.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-0F26A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-19JAM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-1HI56.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-1PPC2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-2BLGI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-3ARAD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-3F3J4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-5QIUK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-8JPHF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-8KGOT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-8PN46.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-9C1A4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-A5R30.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-ANGVQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-BPMOC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-BQTN2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-C56MN.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-CF272.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-IOHQH.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-JLBT3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-K0O0I.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-K80MD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-KFJQ9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-MA3IR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-MLRGO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-O70FC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-Q6Q9G.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-QNJPD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-SAOJP.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\is-U8JGU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\easyrecipesearch-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\easyrecipesearch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\frompdftodoc.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-50U29.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-9TQO2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-BBP1P.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-F5I0L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-GUQJS.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-JRH00.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\is-K5CNV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\manualslibrary.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\mapsrch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\myofficex.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\logo\tvsearch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\lunch.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\mic-light.ef89f88c.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\mic.0bbff27e.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\more-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\more-light.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\more.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\more.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\pork.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\search.ea2d187a.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\steak.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\vegetarian.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\img\warning_1.20159b81.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\index.html (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\is-2CL6G.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\is-JI2PF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\app.3f57d9f7.js (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\app.3f57d9f7.js.map (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\chunk-vendors.f61cf75b.js (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\chunk-vendors.f61cf75b.js.map (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\is-3ARDE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\is-ATEEL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\is-JGDB3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\appdrawer\js\is-VQD1M.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\css\app.29e34c24.css (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\css\is-41MM9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.557060180794725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F83D720B236576C7D1F9F55D3BB988F9
                                              SHA1:105A4993E92646B5DBB50518187ABE07CA473276
                                              SHA-256:6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
                                              SHA-512:FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\de\is-S9RD1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.557060180794725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F83D720B236576C7D1F9F55D3BB988F9
                                              SHA1:105A4993E92646B5DBB50518187ABE07CA473276
                                              SHA-256:6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
                                              SHA-512:FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.425694157692337
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15DB634B70D6D9D6CD41BAAE3F02EB14
                                              SHA1:1456FFE09DF896271A746F9CB40A230F188AD397
                                              SHA-256:E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
                                              SHA-512:1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\es\is-QDMU5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.425694157692337
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15DB634B70D6D9D6CD41BAAE3F02EB14
                                              SHA1:1456FFE09DF896271A746F9CB40A230F188AD397
                                              SHA-256:E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
                                              SHA-512:1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\favicon.ico (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.588569516197988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B4621370ADDCF4306669C9E7E45C865
                                              SHA1:EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
                                              SHA-256:E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
                                              SHA-512:586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\fr\is-0FSFV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.588569516197988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B4621370ADDCF4306669C9E7E45C865
                                              SHA1:EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
                                              SHA-256:E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
                                              SHA-512:586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\arrow-left.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\arrow-right.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\back-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\back.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\breakfast.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\camera-light.14f45916.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\camera.cc7b8dcf.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\chicken.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\clipboard-light.1026c11e.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\clipboard.c4755019.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\close-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\close.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\dinner.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\ers-generic-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\files-light.675f9318.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\files.2205c6a9.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\google.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\healthy.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\apps-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\background-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\background.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\bookmark-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\bookmark.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\calculator-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\calculator.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\compress-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\compress-win11-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\compress-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\compress.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\doctopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\doctopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\doctopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\doctopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\exceltopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\exceltopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\exceltopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\exceltopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\file-explorer-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\file-explorer.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\home-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\incognito-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-0DQIV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-17J5V.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-1DPNO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-1PR95.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-1SPA4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-2N64B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-2SOBD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-4E296.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-4KP7A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-5DUKB.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-6DG0I.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-6RD8O.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-7430K.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-7PK47.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-8IDEO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-8V8LL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-9F6ES.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-A5TH7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-B248D.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-BC8V7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-BFTH0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-BO75B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-BR3UT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-C557A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-D2G5U.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-DJOM6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-EG600.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-ERGFR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-F0QBO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-FD5QO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-H4BJ9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-HGA4V.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-IBBG3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-IKVG6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-IRL4N.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-JOERO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-K8K1F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-L8P63.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-M29JA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-MIBRV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-MLCAR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-N3BE9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-N5U2P.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-NG3L8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-NMNQT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-O4OER.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-OEQ2G.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-OP5PG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-OPIV0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-OQ1HD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-OV5EK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-P9UFM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-PFD3A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-PM6T9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-PRK97.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-PSJTF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-QUQ08.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-R9MFJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-RJ28B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-SV0L1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-TFQL2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-U1MET.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-U9AH5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-UFPKD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-V0MDB.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\is-V4DN4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\jpgtopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\jpgtopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\jpgtopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\jpgtopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\linkout-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\linkout.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\menu-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\merge-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\merge-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\merge.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\mp10-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\mp10.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\newtab-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\newtab.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\notepad-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\notepad.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftodoc-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftodoc-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftodoc-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftodoc.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoexcel-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoexcel-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoexcel-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoexcel.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoppt-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoppt-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoppt-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\pdftoppt.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\ppttopdf-ico.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\ppttopdf-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\ppttopdf-win11.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\ppttopdf.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\print-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\recycle-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\recycle.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\search-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\search.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\snipping-tool-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\snipping-tool.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\speedtest-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\speedtest.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\splashed-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\icon\splashed.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-3CMRB.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-635UV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-89BMA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-8LDM9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-8VDCI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-9GS6D.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-AJ67B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-AP755.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-CSVD7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-DEUAK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-EP43M.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-EQOPK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-FAUNO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-H6BE7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-HA3E5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-HN8C0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-J70O8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-KL4JS.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-MBQAL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-MQ5JQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-NT24L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-Q1K5F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-Q54P3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-R55D9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-S1KMI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-SM8O3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-TF78A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-UGS2F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-VCD0H.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\is-VUIGO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\easyrecipesearch-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\easyrecipesearch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\frompdftodoc.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-6GNUV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-77298.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-BRFEJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-EBIBR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-FRADC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-MVIMR.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\is-QL86C.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\manualslibrary.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\mapsrch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\myofficex.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\logo\tvsearch.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\lunch.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\mic-light.ef89f88c.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\mic.0bbff27e.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\more-light.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\more-light.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\more.png (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\more.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\pork.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\search.ea2d187a.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\steak.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\vegetarian.jpg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\img\warning_1.20159b81.svg (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\index.html (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0286F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):402336
                                              Entropy (8bit):6.138265912892721
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:147328DEF2E79A86D7335A661EECC051
                                              SHA1:98FF30131D77CF28807D50B97CC92CC8655E235C
                                              SHA-256:7442D48A24C1747CB17D80E95C4D7343DE16E14A252484ACE3BE3FAE55B1D641
                                              SHA-512:D26F6627F09CAB90AE545DF68F2DF006F0BEB988CFADB16F6AF56A454E854A9B9C10D2CE787052B80536F9D05B7286D57E42F361F54944E20DF99B3C1C49AEFB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.........." ..0.................. ........... .......................@......Ez....`.....................................O.......p................I... ......|................................................ ............... ..H............text...D.... ...................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B........................H........7...#...........[..P...........................................:.(;.....}....*..{....*:.(;.....}....*..{....*...0...........~<...}.....r...p}........(.....(.....r)..p.(........(;.....~<...(=...,z.....sj...}.......}.......}............{............%......(>....%...C....%...!....%...%.........%....%.........s....(....*vra..p.(....,...}....*..}....*..{....*z.{....,......(>...o?...s@...z*.0..(........{....-..(......o....&....(V.....}.....*.................0..T........{..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-0HAIA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):198472
                                              Entropy (8bit):6.150725701658664
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:665E355CBED5FE5F7BEBC3CB23E68649
                                              SHA1:1C2CEFAFBA48BA7AAAB746F660DEBD34F2F4B14C
                                              SHA-256:B5D20736F84F335EF4C918A5BA41C3A0D7189397C71B166CCC6C342427A94ECE
                                              SHA-512:5300D39365E84A67010AE4C282D7E05172563119AFB84DC1B0610217683C7D110803AEF02945034A939262F6A7ECF629B52C0E93C1CD63D52CA7A3B3E607BB7D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ............@.....................................O.......h...............H?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1...*.0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2*..J.Xo3.....J.Xo3...(...... ........J.XT.*...J...XT.o3...*..o2....Y./..*..o3....%3 ...Xo3......Xo3...(.... .......*.*..0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._..*....0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-10GPT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):110944
                                              Entropy (8bit):6.427912093819953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:33B8972FA6B00B8922210CA95E5745D1
                                              SHA1:609F31B98831327677E89E08BFF7D7322BA0F4A4
                                              SHA-256:DA18D61BB6B7D35C56CB4F392FAE0844CCA73F72A043A08994BECCB531FF3B77
                                              SHA-512:F85F03E20C8CE40BCF28D883CCD80CED755BF75D515FA66986963F0F4F5AD00BB1823D8C100A75323147B28A4916DD6C598102B18999AEB7B358C196AF4206DA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ...................................@.................................5W..O....................r..`?...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r7..p.(....*2rs..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r=..p.(....*2r_..p.(....*2r...p.(....*2r...p.(....*2r...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1KAF4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):19624
                                              Entropy (8bit):5.015005614388246
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:427C4795260B4AECA74D6FA4AF6AE6E5
                                              SHA1:7FBDAF86BD9D5527EAF883AF701DC535C4CEA4AC
                                              SHA-256:5469472596BBE3058A2A89F1D5B0880A53A0A450159A240BD24F503B77B088D2
                                              SHA-512:CA00D0F23C7AD323C27CF109405F4E7310397632C19A49FD6B71E5A0717D927527470CB563F96A6B772FDD1AA5FCCFC230B6F5DE8B517835892A6F0E062C0FFE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="ClearBar.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <runtime>.. <AppContextSwitchOverrides value="Switch.System.Windows.DoNotScaleForDpiChanges=false" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1MO1B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.857834679374035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37BE4CCE0ED037F8D9A7A3940BD2A2E1
                                              SHA1:96314EC1A59E4BB53C5B609BF79AD4C998A7A988
                                              SHA-256:C81A57D0634C462A6CF49844059E9B170F650CCDF0789519FFD4AE7D28E2718D
                                              SHA-512:CEDAC24F414CCE5053FDF10779DBD153FCEBAD69B3960F75A5AB1110DA18799C79DC01B30269641022FCD874A331BC2DC7CE1A7D1A60DC90E109DD55B58665DB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2*... ...@....... ....................................@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-1T6AN.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):48256
                                              Entropy (8bit):6.234996524588368
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                              SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                              SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                              SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-20DGM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21256
                                              Entropy (8bit):6.945812678642078
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7AB10B31C5CE290672B319D403751E95
                                              SHA1:ED23E654968B3704A82F613B06BE5829E0CAAD70
                                              SHA-256:1F5C1ABE1B2720680170388569354D8CDA9D558B53AFF7CAF175CE0F7E3733E5
                                              SHA-512:65ED3AFF2424E7560FCC44380DC719BF200D444F9B06AF7F916D52152C330D55A7F4B96D0C1D2B291B07D82805C71DD9850F2F5F612F00ADFCA1CDF117C6B14A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-23NVI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.940882019021464
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8B8C402311D7AB87E588675E736414FD
                                              SHA1:EB8C010A35B461402C1C33133F1B61C78BE8425A
                                              SHA-256:55A30D92D163CF1807BEA6DC13B4C13E70AEBBB034DC77EAEF4F4394730DCD8E
                                              SHA-512:D03F450A3A19320DE71145E48CD7C088D9B50D0A683CC9A79D8967DCE085A6F63CBE537FCA1C6208865EB52EAFB10189613C7233047318CAEB2FB2C23C34A269
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2A3U4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.8873536206529895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B49BF361F3116DE28176B40845BC199
                                              SHA1:5627E53D15E56868DC9082EDCAE5A653B96B9AF1
                                              SHA-256:BF97F67165231C2A42B95F11D80337B082E2B2BE54351DA44C8A10C06194B369
                                              SHA-512:0FE87438ACD6C14401523987BE617A83DDFD2B42938FC52E0DA5F941F7DC70686CC6436EDD41C4998FD56D5F52D64ACFAB5010B96B1E80C084C4AB9F546202A8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ....................................@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2AFRA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.913851684806603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8BE0CAA60074176FA1E7E63C0AEB6C01
                                              SHA1:4D4AE0D2664025327F28400D917CC59AFD69F33A
                                              SHA-256:30A49D16436E3A05569C99A0C2D21755C2FA323C5B925F9F21C10287CC97D9C9
                                              SHA-512:057F21A7E7496343C06CC497A24E46E59218EAE1838885EEEF7391285CDE243AFE853155F52933959B40F40AA7028A289D15D279833208BBA42BF853D4DF91C6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................S.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2KU8B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.910950453979084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA1FEE108A0750F47B70F25FE2CC55A
                                              SHA1:6523838EF4AAB39D0D3C0DF11C28ADA449EDD592
                                              SHA-256:69B48FF8E6F40B84CDDDB95BCDBB34E1184A2E29CB4CCC0FC9F1A2493648EE37
                                              SHA-512:9C0E69C07B2ED6CAA9BB3FFD9EBA6C82A0B763F2DFB06341F6343C54DBC254505CC0350B96B79DC4062D8D28D47C79824E98BB293C8C85203E827164AF862B5A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2L6P2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.887075475210058
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8CC4C7DFEB41B6C227488CE52D1A8E74
                                              SHA1:93702135DB0646B893BABE030BD8DC15549FF0C2
                                              SHA-256:9DC115AC4AADD6A94D87C7A8A3F61803CC25A3D73501D7534867DF6B0D8A0D39
                                              SHA-512:E4DA7E3AE5CA31E566EA0475E83D69D998253FB6D689970703A5AD354A2AAD1BB78D49A2C038F0A3C84A188D091696191B04E4A39253DEB3B6CB310B72F02F97
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ..............................ZY....@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2MB65.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):154448
                                              Entropy (8bit):5.513799122521585
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D712A5A82A446086443CE00B610D8A5D
                                              SHA1:7ADD96BAA123DB819F2F3D5AA62D6F872CE8FE14
                                              SHA-256:1C7BFF6F16BB618648E699B723AEAFE511515CD6AAD699C25FAAE2A507E22811
                                              SHA-512:225128E58E2F01B5CAADA6FE54B1D32FF6A700542CE22B425649AB22DA2944F796F04D1A2428C542BCAB5348A161CF73F5F9A1E7BBF1F6417C4D507217FE3FD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................DR....@..................................,..O....@..................P?...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r;..p.(....*2ro..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rK..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rM..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2O16F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):1072640
                                              Entropy (8bit):5.857610826427647
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5C0C906E41C10498072B74C065FF8FC5
                                              SHA1:B3F2FC11BCE6A10A4F402A964F03170952E36BD1
                                              SHA-256:785F8E36FE70214F3D5E36A1034AF65917C9ED9A157A6CBADF1642C240F4E736
                                              SHA-512:6AE9B9A8298FF540932D98E9734CCE40012BDE33753415E2A1171D7E036411F5287CF639E509A59DE3D0005BD946FEF457BC92EE1945973434C326E1C4A368B6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z..........." ..0..T...........R... ........... ..............................4_....`..................................Q..O.......|........................... Q..8............................................ ............... ..H............text....R... ...T.................. ..`.rsrc...|............V..............@..@.reloc...............\..............@..B.................R......H........@..................U...P........................................{M...*..{N...*V.(O.....}M.....}N...*...0..A........u........4.,/(P....{M....{M...oQ...,.(R....{N....{N...oS...*.*.*. $.. )UU.Z(P....{M...oT...X )UU.Z(R....{N...oU...X*...0..b........r...p......%..{M......%q.........-.&.+.......oV....%..{N......%q.........-.&.+.......oV....(W...*J.(O....sj...}....*f.{.....ov...,...}.....*.*J.{.....ow...,..*.*J.{.....ox...,..*.*....0..........(X.....(Y...-..{....(Z....+.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-2QTC0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897588144752097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:824053272B268C577E9ADF17ED398142
                                              SHA1:5EA3F290ECDE1BAB983CEEE2417A688B7ED9B7F5
                                              SHA-256:04B9235F64C9C846F8A767230714895DA87C7AE2CD0105E9D14835AE46F0FED8
                                              SHA-512:F475DCD2CC23FDFB017688713170FCAF8FEA05869A680613EA4AD84CB358ED0F2442DB0FF0DCBD739E3CC3DB7128A8F4A568AE8E5AF6A8840319B02630E420B9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-38F0A.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22200
                                              Entropy (8bit):6.818690002285853
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A3DA139180E9FAB380033D8D1FE3995
                                              SHA1:3CA31DE7F0F0784559E5A73EBD0EFB42C34D18FC
                                              SHA-256:63AAF632EE7F3BC852C4D71C742CF1D26F18F784F6C89113E056B2599BA8F514
                                              SHA-512:D991298419FB5290D6906A1F9FCCEF56BB3E17506E235C85B4D979EBC49ABD4F4B3123697E675346B57829C3EFDEED6291A155D69348CD55B8B6B2EEC9F804A1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................Z4....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-3FN0L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):23936
                                              Entropy (8bit):6.756576538241564
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA98A0F020248C2BE1DD40C07092F22A
                                              SHA1:EF6B3CCFF90BEDDAB5CE6F60B4CC23F75EDFD009
                                              SHA-256:CAE99F910874288AFBF810968D13B79D755CD4B2006609EC036EA4934181CBA5
                                              SHA-512:554A25C761102DC41A9E421621E329868D1162AB29F47E59754C8FCFAE0C12BBE8200E1B5975ABF926F1DE0977A5407C43202AC8A2801C69A7F01D95B6A1E959
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................?...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....*6.o.....(....*6.o..........**.o.......*.~....*.~....*.BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.|.....Z...1.Z.....$.....$.......3.D.......|...F.|...c.|.....|.....|.....|.....|.....|.....Z...I.|...}.Z.....Z.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-40NNL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):18024
                                              Entropy (8bit):6.343772893394079
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C610E828B54001574D86DD2ED730E392
                                              SHA1:180A7BAAFBC820A838BBACA434032D9D33CCEEBE
                                              SHA-256:37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
                                              SHA-512:441610D2B9F841D25494D7C82222D07E1D443B0DA07F0CF735C25EC82F6CCE99A3F3236872AEC38CC4DF779E615D22469666066CCEFED7FE75982EEFADA46396
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."..h$...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v*...#.;.-.h.......0..#.....a5|T%W...].!.%'..9.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-4BM0B.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22248
                                              Entropy (8bit):6.861480146265617
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F39A35095CFD0019D6D4BB8461750BF0
                                              SHA1:AD55AF22E5479A5ADDF01D698138E5149270E3CF
                                              SHA-256:2E2D28A0802D8C8C08C0D422F48733AD8BF1DFAE75F5682A4A3DF8898E7E819F
                                              SHA-512:25FC9D4254DE0AFAB9AE3E19B8B225E1D875DCACE6CA2C83F768B62C0E2B331CC9DD2988DFF7994B5819FB0DD7A89A49FD19E653FC2E4EE656182E08A969A93D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-52JU8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25984
                                              Entropy (8bit):6.291520154015514
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                              SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                              SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                              SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5A214.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.85763123423511
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7F65CCBF58C39F3853BB8DC4137DFD12
                                              SHA1:3946DFF0B68F0CA01689BD44C348559ADF548258
                                              SHA-256:0AB1F7F87B7C2AFCA57D394E4F4E262C82BA3209CB0A750CD66401FB33F21ECA
                                              SHA-512:FF7D953EC4B82C10E64FC85D3AFC8A1A58582170EF1752D4688FA1D48EFC490DBA5F0A784E748F7902E96FD885EA868B1A84DE44F48CF071975F3CD3F8E52C6A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2*... ...@....... ..............................'.....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5FC31.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):72704
                                              Entropy (8bit):5.973895173040258
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55E564E90852CDA28B7CAF06225832CF
                                              SHA1:CE049650E93CE17E737F86C28EF2165C7E256A6F
                                              SHA-256:C75ED43EE8DEDB510AAC00DB08851D54A6DBB16F38B804D5A69CF72A355C7672
                                              SHA-512:D99BE1899050252E7D10B71CF39BDAC897A254BEB12FFCD23E433D225D155E35FC3E6505AF47D681465AF6680D513D9692E761BFA855801C9DE07D4AF5A2E9FB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............1... ...@....... ..............................i"....`..................................1..O....@.......................`.......0..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......Pm..............d*......<0......................................f.#.......?#.......?(....*&...(....*.0..S........(#....($...-..#........5.r...ps%...z.($...-..#........5.r...ps%...z..}......}....*..{....*..{....*..{....*F#......X@.{....Z*F#......X@.{....Z*..0..6.......r)..p.{.......r/..p(&...r;..p.{.......r/..p(&...('...*^.u....,...t....(....*.*...0.. ........{.......((....{.......((...X.b*.0..2........-..*.{........{....()...,..{........{....()...*.*f.-..-..,..-..*..o

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5HUBI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27648
                                              Entropy (8bit):5.804767406769817
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27E89E536FDD09F8D2C5911C6B57AD90
                                              SHA1:1250FF1AA36A20528F7A489B5F29764E7D85CE40
                                              SHA-256:CBD69D92834309D6D1DB85489627ECFDEFC534E7E1DC1D6EC06B0BDF2723044F
                                              SHA-512:B942462FE3D313DAE64E0417D5C9E13137F467AA3C55343008111B1DAFEE465641FA9A5E7E160F863D1516E31AB34776C8AB2CF0FD02D8E966BA2C74A5EB45AC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w;............" ..0..`..........F.... ........... ....................................@..................................~..O.......d............................}..T............................................ ............... ..H............text...L_... ...`.................. ..`.rsrc...d............b..............@..@.reloc...............j..............@..B................%.......H.......d3..8>...........q..X............................................0..f........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( ......('.....(.....*...0..n........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( .......o!.....('.....(.....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-5S69T.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):488448
                                              Entropy (8bit):6.015215990524562
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BA42FE7DDCCC9DB8F8BFEFDF4178C67E
                                              SHA1:CC28125DEA3F4BF77A564E4E09A8B09BCD2AA446
                                              SHA-256:85B3596AD0E426646A774FAEC082E612AF0121A03CE8790412B6E6808CE2A3F1
                                              SHA-512:9843638E19D04B946830E7039BF195EED70A174F3F1A9DBF6F3612E18626CFC72E5B95858E1D1CAE3FFB4777D92738A2FB5A2CE53C4CDE1F6A854EEFEB94E5E7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H'..........." ..0..l............... ........... .............................._.....`.................................R...O.......................................T............................................ ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............r..............@..B........................H........c..<&............................................................{J...*..{K...*V.(L.....}J.....}K...*...0..A........u;.......4.,/(M....{J....{J...oN...,.(O....{K....{K...oP...*.*.*. 8..z )UU.Z(M....{J...oQ...X )UU.Z(O....{K...oR...X*...0..b........r...p......%..{J......%q>....>...-.&.+...>...oS....%..{K......%q?....?...-.&.+...?...oS....(T...*2.(U...oV...*..-.rE..psW...z.(U....oX...oV...*:...(....(Y...*:...(....(Y...*N..{Z....o...+(Y...*z.{[....{Z....{\....s]...(^...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6CHFM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21184
                                              Entropy (8bit):6.933179959460408
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28141960A88365DF6A60B0C6FF831B0B
                                              SHA1:B56C3D2E270B1C793A2EE17CAC9C98B178258E94
                                              SHA-256:F2E74A3EC2DC753C9A48FA9A677775F949EB1E02FC1BB8BF38C39E8D2AB147EB
                                              SHA-512:CD44E789A6C04E2BC3B07810B57CC83787F06530065FDCE069D89E42557F40770923CC705E73B7699731166F19FD7133FBDD8EDD578D308A4F72CBB29E76939F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................d.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6FJHT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6LN71.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.921540746927502
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99604779C668D9B8EF913854B9A24F9D
                                              SHA1:97B62A3DBE2465B4C995E082AD6FF183F6267F59
                                              SHA-256:8270D1248950EE8AEE5C2AC2E321DF07E65C7A94004AE03C857DEACD231A5542
                                              SHA-512:BE6DEE6E7030B400EAC68AC289EC9B74BFE0140EE59AF5E68BF43A63A821C6F6AD9CA03C501896A6C92464BF8116D7996FFE640AB51BD9FA96673D9794AC82CD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6SI67.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.907185647363724
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55D9528D161567A19DBB71244B3AE3CE
                                              SHA1:8A2FB74CF11719708774FC378D8B5BFCC541C986
                                              SHA-256:870EE1141CB61ABFCE44507E39BFDD734F2335E34D89ECFFFB13838195A6B936
                                              SHA-512:5338B067297B8CB157C5389D79D0440A6492841C85794EA15B805B5F71CFED445EFA9099C95E5BDEF8CF3902A6B10F032BFC356B0598DDE4F89FA5B349737907
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................L....@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TBP4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.870719034523618
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D00682E84D1D773D2160B63C0380BA6
                                              SHA1:5E4158533532A27E03D0CCC9A0AF5E89FFFD8637
                                              SHA-256:D0D90152136A0ACF340FB345098F2E5C718BB13F3B5A809D7BE4D9948B8574D4
                                              SHA-512:991FC952B452446255963AEB4F11C74E7116E15B666924452F3C0D15517322EF1D925DC44BC1F003E8483B5C0B34AD71D54ECAEE360FD9E942664FDEC4E37E99
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~*... ...@....... ..............................X~....@.................................,*..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6TPNG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.941945190587086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:559C98EB9633C7BA1BC813F8E6E0E9A5
                                              SHA1:311F52B31611E6DC5FD4C0159BFA452C22980CA7
                                              SHA-256:CC62F3B867D50083C2932061F20662C698D2E1A741C4D2F9DF1FD2D435E3EF3C
                                              SHA-512:E241C16869D1CDBB2C6482A7C5B2AF93DE4BA0CEF8185B8826EEE35ECB174F35F7585C8AE0320F7F4F6B80F3BB5B3EDAE2383760F2F35637F03C3A0E38E0875C
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-6VU9P.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.922388458113732
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BFCEB4FACA75681137455CD70F8038B6
                                              SHA1:BFA0E27BE1D56BA48918A9B7CA7090AF7779A10E
                                              SHA-256:9A4595DBB128E2D8F373B3AC45478E7131F4D181B50EC821EC8CB88BD46BD5B8
                                              SHA-512:58D7E8D6FA237A6EAC018C0A88D6BF76AD9EE49B6A6790B64E68C33EBF80AFCB4223881AAC6821132B877E7D848BC917EB9490590CDB297F362C9B43143D6713
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ...................................@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-75V95.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.8884260737638385
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:328D12AF9613B0F3F25320B85DCCCBF4
                                              SHA1:09D02B85A094E925AC3C5D8B1ACA096B730C160F
                                              SHA-256:8957F0BCEA6AB8A011A53AE62466505199F11A228F87F3809931D974F87078CE
                                              SHA-512:16569ECB727ADA36811E72FFC925F07AA21B8A627BE45F1EDA18CF2B759939591DCAFCB2D087596EE903C5ABFFAF19F56F25E9710EF22874C934CAD19537B798
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............*... ...@....... ..............................\.....@..................................*..O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7I3RJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.925439366434707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D40515A84448B91315F956E6D1A6C64B
                                              SHA1:7FE773332D0461A252E52BE720A7794FCAAC7BFB
                                              SHA-256:CBE29672CD2B6A0EA97B55F3844FBEDE3E591996F39C3AA1F829F2FA50551FA9
                                              SHA-512:322F82AEB9EB9DA22257AC9FE835BF1C54C1BB268D37F0F97A4CA52BB42F6ACCCA9C8DBDB96D6D695FA69C24F5069978A4B6F1E960EE81D9EA671CCD30A348D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................iR....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7QFPE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):15872
                                              Entropy (8bit):5.392167003572151
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65A2CDAA1A7B477269B24B128C6E7CEA
                                              SHA1:3A154ED01006332F3A7A80DC45A323C7DEE10E48
                                              SHA-256:9B7D806282ABD8EFF2CAC6B12E097E57603AB0EDE82ED5752F2B01B17FBA6B07
                                              SHA-512:781D12BE7CD13FA90E9C685957782420F5D64B092B9115CC7E019AC670DAE12BF14421AA8F4DFB08D04E0A818A25C0091AC47CAC60DBB3EAFBA2D168C67E398B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.e.........." ..0..6..........^U... ...`....... ....................................`..................................U..O....`..x............................S............................................... ............... ..H............text...d5... ...6.................. ..`.rsrc...x....`.......8..............@..@.reloc...............<..............@..B................@U......H........+..((...........................................................0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..........r...p.....(.........(.................s....s....(.........r...p.....(.........(............s....s....(.........r#..p.....(.........(....#......i@............s...........s....s....(.........rK..p.0...(.........(......0...s....(.........~.........(......0...s....o....~.........(....#..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-7SD3T.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.474871175289035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3453AB2CC06145E8B65FF572781DB0B2
                                              SHA1:12D6CE422A96D1FBFE62C07427C41EF446357229
                                              SHA-256:99EB1DC3D85D8AD6F6A443D621870E256C43A2DF6C7D9DEBE564FCE06ACFBF67
                                              SHA-512:FBDC6E62507E2C5B1B67B87114E65D4EF0C8C9F05FCEEAD1EFDD517415A5BFD5EE52A7E54A4D8DFF2016B361BFCEEED3BBAA0A6EFB2309F6067CF71FD29ADE76
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..|..........B.... ........... ...............................t....`....................................O.......|...........................8...8............................................ ............... ..H............text...H{... ...|.................. ..`.rsrc...|............~..............@..@.reloc..............................@..B................".......H.......x?..@Z..........................................................b......(+.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*6.{.....o....*V...(,.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*..(-...*....0............(.....o/...u......,...o;...*6.{.....o....*V...(0.....s....}....*>.{.......o....*>.{.......o...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8HG11.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.863412750707488
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF318475E6A7A56789ABB0F98C37ABE1
                                              SHA1:33D1EBD7212D747C8723CFB9E4292C99A641B964
                                              SHA-256:0383DC02FDF0B5D4612D8CAAAD13D594CAC1609C8240B73DFD6EA5803F5E17EA
                                              SHA-512:5C67456A65FD051147281E14041F5165C1852FD6519DFC8DFCF9C86F20217CDAD9E2D26F815B557B99E2DB3500AF47B2DF8A1225A659FA1069815CD62302458F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N*... ...@....... ....................................@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0*......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8N9GS.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF, LF line terminators
                                              Category:dropped
                                              Size (bytes):96683
                                              Entropy (8bit):5.257126320655635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C3757A5D36911A561AAA7E7A70E712B
                                              SHA1:E766D4835E1FDC89F22894CB07324FE9CE2E6972
                                              SHA-256:49110DCBD7ED10E54A5A5F6756CF179FEED6121EF9E9277C53C9DF8E1C6786EB
                                              SHA-512:A3674017867FD76225D525C8F59C02097639ED016024FAF73CC82D897DCBEDD02A16991DC504E707D69BD54E69029DC8E483F83C1DAD78E88651FC141D789ED0
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="Clear.exe" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />.. <description asmv2:iconFile="clearbar.ico" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <application />.. <entryPoint>.. <assemblyIdentity name="Clear" version="1.1.3.0" language="neutral" processorArchitecture="msil" />.. <commandLine file="Clear.exe" parameters="" />.. </entry

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8OJM2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):333824
                                              Entropy (8bit):6.105576145657233
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A844AC745A4005FBD3F51D79FF88583C
                                              SHA1:92671774FD4BE9781A77D2788A8DDDBF8981EAD5
                                              SHA-256:74FE1A6A1E36BE7D893E31BBB4D4BD83BF4B927E715276CD5607982139818EBD
                                              SHA-512:5F0734058D9146FFEB552ABF443DF5097CF134A4737BED499467830E08D97F5D1996C1F1647C5C12289CA4D4209EFFD480010AFEBC59D50290D4CA7D45BB41F8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ..............................I.....`.................................0-..O....@.......................`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{....*..{....*V.(......}......}....*...0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(....*..{....*..{....*..{....*r.(......}......}......}....*..0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-8UBLU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.913262967781329
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6DCD91B6A029794728F4EDEB2BF2E42D
                                              SHA1:82BA1313448B431893C14D866F46D47B620514A9
                                              SHA-256:02416BC542BE82002B8B81ADBBBCDCC8D098104020D09B571DC674B5BC19A177
                                              SHA-512:2566F369EDEE9313E823AA2667CB95977F0DB57B4B47DA62F44850811F524D0598FDE6F5BB082BB3325789E4B256E970603B4297D3586F1C435498430723A38B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................s....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-96JN4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.915565842835677
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27C7D752C11C3F43F28EB31968E73E2B
                                              SHA1:51E466218025126C5E524AFD2086F4AB0BF3660A
                                              SHA-256:260C6250EF9B57DCA99B4CECC533F9A34857B5A32B5351202F776163841200AA
                                              SHA-512:393D1747911A7F91F4C4F4F363A3782F24E00431478088DA454823A223A4E75E51D9B010FC5D9746E2BF0185BE90071B6CB70C777337D718B39151EEF6B486AA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................C....@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9E9TN.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.924199325151996
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9088029E38B2A393F22AFD9E576CE86E
                                              SHA1:05E65EE95F647F38C717C73A0399870912DD374A
                                              SHA-256:3468E0C875DB94A8F45D56AB76BBCC677B942CA51A23649BA3C5AD1B20E391F1
                                              SHA-512:23DCF5819996EE0F0C8FE044D6642A12E98A40309CE1F3F74688CF8E3DD6F6ED230AEC391FE7E511E15FBBBF14BFF09F976E923F22F2D68AD816D8FFAD17F101
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................d.....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9GTP5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.872325269765102
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9F31B6954FD453F13B5F39DA36F2E8EB
                                              SHA1:7A6276348D85EAF00AE6958117797045929078CB
                                              SHA-256:18A610B8BAD43CF784CDE4D4902A238F2281C2A677DAAE790CAB55F6DA915979
                                              SHA-512:D3696D4D60CFC5AA5834F60A0B97A4F3A3F8EC3FB05BEB3C3D927426B72B3E5463C628C7DF950E43FF1344823B8C2D39730BA47BA0F2FEC7A0CFCDC237A5BCC6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j*... ...@....... ...............................R....@..................................*..O....@...................?...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-9S7BD.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.910934602645047
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29B0A1554E54611EBBA7911049F26FD3
                                              SHA1:D707745E72D2F39374F2D28AF52AAAB7888B93AB
                                              SHA-256:2805A18724A24034AD6ACB315DAC516E479CECC5F3753204052657E560932D5D
                                              SHA-512:17558306A611BFAC6982D5650335B05EA407191290B653C028896142EBEE2ABCEB22F7D71926FBBCC3FAB8227C61A5FDA0E770ABFCA021AC7F891C9C7EE42E81
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................n....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-A2NCU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.9009750652396775
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2EEC710DBAACD32BEDFCA09ECA8DE52D
                                              SHA1:2CB934305D3648FF29FDBC7D92485003F8458848
                                              SHA-256:222BD77C5692C2961E8C3638F6511D6F7CBEB9E0977E2D5C3BCA6739A5311F37
                                              SHA-512:03F132E1BAC629A394A093D59550B22D5FD4C4D6F244697173229282741A9CD6669C4256C024467CE94293C74F304560066711C35620AB4750621502AA67B5B1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................f.....@.................................T(..O....@.. ................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AI5I0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):186
                                              Entropy (8bit):4.942919098144707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9070D769FD43FB9DEF7E9954FBA4C033
                                              SHA1:DE4699CDF9AD03AEF060470C856F44D3FAA7EA7F
                                              SHA-256:CBAF2AE95B1133026C58AB6362AF2F7FB2A1871D7AD58B87BD73137598228D9B
                                              SHA-512:170028B66C5D2DB2B8C90105B77B0B691BF9528DC9F07D4B3983D93E9E37EA1154095AAF264FB8B5E67C167239697337CC9E585E87EF35FAA65A969CAC1AA518
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2"/>.. </startup>..</configuration>..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AMMB0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.911176710124494
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:090FF56C4FE2EEFF2E16F03099AD71E1
                                              SHA1:EF317CACC230A58A3B2FCC6CC079CC763AFCC7C5
                                              SHA-256:5F560E1DD529BB2529D7052E04008449F58D0439C2BB43437D7B5D39F84F949F
                                              SHA-512:FDAC43D0A18D9158DB4438349A7A550557A36E6ED0665EFCB65A046A5BEB5C38181996CBF6D860B8AD01C19E35315BB61AE766CAF06B23985E046484DAB45256
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................W.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ARVMU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22832
                                              Entropy (8bit):6.823696761227228
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:06D000552ED6785988AE188FC35D1B86
                                              SHA1:B0A8868D459FE0AF34D16C263CFE0202C414DC53
                                              SHA-256:3C8630ACB43C12A6A317227FF2922056ECD991FE945464FDF7EA81F1293A479F
                                              SHA-512:F3E5E97AAF3D26EA62C64787198CCE6DF703EA3A4EBB389BEBC84B424C8129A0181142A4FA5D965CA3106758A047D0E1A723F181AD293FD389C4F1B8D290B5A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................j.....@..................................-..O....@..................0?...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......|...#Strings....x.......#US.|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AS9AU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):308840
                                              Entropy (8bit):6.45239473803924
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C687CBDEA0138936FC4B88B3086207CC
                                              SHA1:93C188E269C21893DE07642AF022318ECAE31BAD
                                              SHA-256:2C522CD285DE2E3A02520F91203F548E454B980821F10DF90E801BD7D3F5C43E
                                              SHA-512:2692EE13267F1801D283B03DAA46CFA61E72E308CE441036F87E6A8492999113B5C82D89173E2E9E0DC64B0867592B24B031CE4E8652ECE4D3F281189C547F11
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u............." ..0.................. ........... ....................................`.................................D...O.......................h ..............p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H..........H................F............................................(....*..(....*V!...7....s.........*...0............-.r...ps....zr...ps.......i.I......+b....o....,H.......rY..p.o....o............rY..p.o....o....rY..p.(..........o.....+......o.......X....i2..(...+.*..0............i.I......8..................o!...o"...,)......r]..p.o....o#.......(.........8^.................o!...o"...,)......rg..p.o....o#.......(.........8..................o!...o"...,)......rm..p.o...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-AT07R.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.935501042478791
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F554762FC38F81CB22D1DC8AB5CD40D5
                                              SHA1:A67FDACEB10E828805A9E24FE0C59E1D73D19A7C
                                              SHA-256:566775F5502C3C1FA70ACADE145293DF5D02C1A9F031820D429605E9B4584B44
                                              SHA-512:BD23571BF9D0FE62BBF5FDDCAFF6B8F383CCC728AFBCEEBCAD8404D68C02EA1F55D4A22306BFC86C30172E70C6CF5425F2FF8877AAA8758A51C48CF4303BD2AB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B3VJL.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):31608
                                              Entropy (8bit):6.6075135088084505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:60F59659DB517C2F4DD4C5C583D43097
                                              SHA1:87ED79D195D8D93AE1155AF08857F751A7ECA245
                                              SHA-256:B84B93BE455CC7D14EC0C88CE08DAFAC7B6AAC2E549C969E7126EB48C31F8B1C
                                              SHA-512:90BCEA3BAA04146F08013A832633957C6D511D5EB52270575EF9A571153384B5A02C5026361B70940775907B5BC710B2C91627EEACE432744F3B9E5E1ED509D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<..x?..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8*...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o....*"..(....*....0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....*&...{....*.0..4.................}......+....{.....".......X.....{.....i2.*.0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-B8O8E.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.914858816124373
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E04CDB6229D83768285ACB08D870F23A
                                              SHA1:A181F5CC93E9273D9169A9954A74D73BC1852980
                                              SHA-256:719AC73BB261E0A13574F5A198126CCF40352264958DEFB555280D005134C704
                                              SHA-512:257FB07C0D86E292FE6FA88E03B29994CB9864C17A535CE7B366A728EAA4B3A803D88A23157CAA457D0B681A2C0D97DD7D9A2754300B73030D9A09C4E9004772
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................F....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-C6SSC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):4.280980574705485
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B3C796CFC5C246A20207CF719C71C37C
                                              SHA1:A00511E18C3C8C72012F0C51E76BA44501969CF5
                                              SHA-256:9127EADFF877E7142AFB0E4239F77A52C47438A7A0A467E7744CAD07537DF04E
                                              SHA-512:2BDCE40BFA6C4B716AC637D7231744A5DC105DE8FF642D15552FFC3780984130FE0B5F553F29F9FD8B7BC868424CB5D5BF51A19E1C432E21BC375D8C90C48638
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............>4... ...@....... ....................................@..................................3..O....@.......................`......\3..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........%..@............................................................0................2.r...p......(....s....z.o.......3$..1.rw..p......(....s....z.........*.,..-..,.. ........X...b...`...3...._.....s....*..... ...._:w....s....*.0...........o.......3.r...ps....z. ...._-..s....*....._..-..........*..1.rC..p......(....s....z...+$.o.......3.r...ps....z..b...`....X.....2..s....*....0..............8.......Z.._d......._,...0j.,).-...._..3Sr...ps....z..._...@r6..ps....z.-.. ....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-CJA9H.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21280
                                              Entropy (8bit):6.9260824081196715
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A964808487E671BB369DBC0E4DC5A947
                                              SHA1:C3848473E42E2F9B4D0A00180EA9ADE654432587
                                              SHA-256:63EAB38EE9F4DCD686C8E6A4F01E1E2A9BB91E52B20AB4DDE0C28061E9261860
                                              SHA-512:7352368B68835ECC9C5943AE2F2BD5CAB775A7FBB018AF7683E74FAD1731A9738AE14EBE0BCCD854A223AB762FCA7EC11411FDAE865C5C6DDD034900FA55CFD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................G....@..................................(..O....@.................. ?...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-D4FI6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-D8F8K.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.898664332146086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2A459C2C395F54352A16DE4AA0E5407F
                                              SHA1:1BA9ECC598E170D779CEB290163AC88E6993935F
                                              SHA-256:4D97E8481B9A27042BB903245625735D82FF627C66797DE619303C1E705D0D6A
                                              SHA-512:28DCB8B6E306015D2004EC00443652CE986AB8E09FB09EB82193BFB0604268CA63C527FF64B6364F63C3ADBCDAF5FCDF4D1494243BFC8F6BB629BD213073BD7C
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................|.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DD01F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):78992
                                              Entropy (8bit):6.056589052139225
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9424E37A28DB7D70E7D52F0DF33CF8
                                              SHA1:81CD1ACB53D493C54C8D56F379D790A901A355AC
                                              SHA-256:E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
                                              SHA-512:CB6364C136F9D07191CF89EA2D3B89E08DB0CD5911BF835C32AE81E4D51E0789DDC92D47E80B7FF7E24985890ED29A00B0A391834B43CF11DB303CD980D834F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................>...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........*f..o...........o.........*...o...........o...........o.........*...o...........o ..........o!...........o"........*...o#..........o$..........o%...........o&...........o'........*....0..L.........o(..........o)..........o*...........o+...........o,...........o-........*.0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... ...*....0..k.........o5....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DKN5Q.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.8850738754620915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AC2F4B435DDF0600D7A866F42F3B40D9
                                              SHA1:0564FF7F7E6084BD6D02D8E6A4127D1C878B3FA6
                                              SHA-256:B56FFB65B842DAAE13F3020B0B04646DB92F89801D2A2F89087D145A996D43F7
                                              SHA-512:DC3E9C3B4D732801DCF43CFD6CDD2672F01E03CB99D804A3F4803FDDB9CA9817BCFD2F96FD94B7B33DB0994F5478CE200C048DB5DBB78D3B24E950262EBF4D28
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ....................................@.................................X*..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DMRO6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22192
                                              Entropy (8bit):6.821272653310105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11D674CFC81B7102C0BC6FFE58F6AC5E
                                              SHA1:DDDA49572D112944EC9AB62B31959AA93A386618
                                              SHA-256:4DC8D588EC63641C28422D648E8DE5E2C030EB7AFEC2071A99DD3BD9A204557F
                                              SHA-512:FB7C628B796A321AD9ECBF01D165E24F151C99D7E60A65D0AF52F779AD60A3203F47B247D44FC47044A68790D1EA4EE458A7BC8DF7EBE9D42C2275A9C11BC324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................).....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................*......................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-DOH0U.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.947656997583423
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AE023BB0BEEE5189A07C7FD4E0CF3FCA
                                              SHA1:846711D4161A3950FACDEF97037898A71F4EFDA1
                                              SHA-256:56BD0C02C734ABF4D7FD1EF2E8B6A9E4BF5E4BAB4E606CD1023D63B02852FA61
                                              SHA-512:62305027AE8BB5B830630FE54F2CF9E607F9B97FFE28912C2CB15D429252668F17EAF2D7CEECF5601C889D5EA52E0B9100F115173BB11B5D6208171792833C85
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................PI....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ECL5N.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):147456
                                              Entropy (8bit):5.921251663921899
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6B4D48DA8444E195EE9F7DBD54509050
                                              SHA1:93C7BF74A27D1721F5019F974EBDB23E4EFD77E9
                                              SHA-256:E3A24CB86E4C5C563A4C639E84A02F679752DFD9593076E6C4C2C79063BC580C
                                              SHA-512:D6C647C2F60A0C064A4507DDF95F3EE6BA45222A84DB824165814FA5044E2FC3D0DCEDBABA4334D4016AD2179CA6913B6505F5FF61BE443CAE871584E4FC8AE9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[..........." ..0..6..........jT... ...`....... ..............................7%....`..................................T..O....`..............................LS..8............................................ ............... ..H............text...x4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B................KT......H........2..@...........LJ.......R........................................{-...*..{....*V.(/.....}-.....}....*...0..A........u........4.,/(0....{-....{-...o1...,.(2....{.....{....o3...*.*.*. Q... )UU.Z(0....{-...o4...X )UU.Z(2....{....o5...X*...0..b........r...p......%..{-......%q.........-.&.+.......o6....%..{.......%q.........-.&.+.......o6....(7...*v..(......}......}......}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EEO25.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27048
                                              Entropy (8bit):6.661112158879877
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3373A24450373CAF0CBB756E10097FD4
                                              SHA1:87C352153804FF5BD4F8AEF8851546F3CF22461E
                                              SHA-256:575E26A455892F1FD77B730E6928F70B760E76094AFE5BCB677D854DAF869AC5
                                              SHA-512:85E005B5BEB7C14BA34C62C38DA635962D1AA4740F91549B8659910EDD10F0FDE1734064B19567BF5BC63DBBBB62399F6CBE0AA323193DA599232DCE22B14A01
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................Ag....@..................................8..O....@..8............*...?...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......|!..l............1..p...X7......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-ETVL9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24816
                                              Entropy (8bit):6.774158289322937
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9087373EEE85190DAF8915E614B1E4BD
                                              SHA1:F434AF8CE30EAF5511E28C0230211F0D8ED4A154
                                              SHA-256:557858E44A51A74646AD07A85CBA56AF1DA13AD26AC2F74EE5D8C3E8A171C221
                                              SHA-512:F728238FA567457D7977FEA667FCCB56C2EFE718A9A362E294934CC752E506E05C5D20C0BE2A309DE2A984DD60C3AE4EA03054185B96C9B5F5F5DE827AF9CEAF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................6~....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s....*..s....*..0...........o....u......,..o....*.*.0..%........s..........(....r...p.$o......o....*:.(......}....*..{....*.(....z.(....z6.{.....o....*:.{......o....*.(....z:.{......o....*.(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-EV863.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22392
                                              Entropy (8bit):6.85070945929809
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4523F60270149BAD67F6AE63375D2CDB
                                              SHA1:FF6E6BCD83A11D40BF53DABD0480A67AECFDCF50
                                              SHA-256:18032D190D0D599823E59C8DD8B588909BEF8888B8BF304723A138B61F1B911F
                                              SHA-512:025E33F6927E634FE187491F40D96B36B2DDAF2ACDE97B340C8705BAE58BDED6C02B8BF9199A1B9D4AC75884C69DC665DC03B34571B1BD178CA1784C5F0D5451
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................#.....@.................................>)..O....@..................x?...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(....*..(....*..(....*..(....*BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-F4SJF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.92602478259668
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E6378FEAEEE2F745417FC025C7850F9
                                              SHA1:E0FAD5EF75676B2ED7CF155AF6602B867FCED041
                                              SHA-256:99920CE34A01A0C07EFD86D6E134BB401993515D001B7567A4116AD222993A63
                                              SHA-512:5A8C41F32598BCF8C8E315B18AD5F1BBC377D7B638DC05CAA3CC47E988536AA0EBE4718D73AEE39ED5004328BE3A9DE9722D8759E5DFD500038E7139DADF9638
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-FA10R.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):183808
                                              Entropy (8bit):5.883721718575946
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:102AA7B6DF14A1B8BC85D63BA6324CE3
                                              SHA1:F67A2C49147395D254745CBA85D3B6C3BEB1F8D2
                                              SHA-256:DF734FE868BD7878F13E52F4DC3EE5DF47735991965D6640D91AAABEA85297C9
                                              SHA-512:F3A1B3F81C9A0A8BD7AD28CFAA7EE394D8486F21C5044559D8DCA66D5FBDB2FF7E5360F6B06F481CFD256F4F764ABF9C2101EE0B4EC6856A6D0C6322CBB015DC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rgj..........." ..0.................. ........... .......................@......9.....`.................................H...O............................ ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................|.......H........J..|..................................................................-....v....*.......uv....v....v....qv....v......*.......-....v....*.......uv....v....v....qv....v......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*2.s....(....*"..(....*..0............(......-..{.....o......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..).......

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G0CR4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):47016
                                              Entropy (8bit):6.126380612996906
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E4A1681E09AEC6EFB00FB2A9355A1296
                                              SHA1:95699D187BF150D319CC64F90064301CAC57F338
                                              SHA-256:967DDDBFE7F1CEB933B5875D65C59CDB835BB063F287A361E8B35DD814A9B14D
                                              SHA-512:49299C773A4C7CCC235C54A91FD07A000CF547B3EE55272E2EE8B2AA40281DC0AF3C3B5A9EDF5CAEE4BEB3AD0DE5A0DEA07159ACEBA582911B78A6B85DB793B0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ..............................I.....@.................................u...O.......8............x...?........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rI..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r9..p.(....*2rm..p.(....*2r...p.(....*2r...p.(....*2r=..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G4L6C.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.913880291057063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:18CE4ECC42FC8D999EF091D812472CF0
                                              SHA1:F874903CEA9F08F1A0887949B47722E6BA81B789
                                              SHA-256:3D9EBC81B1BD3234666C8CE403A5F17A726867C68FFA5DE4EC8EE92599335658
                                              SHA-512:0C027440EF6F6C105B0BF9319F4E0EA421FD310699028AF0A159300145C662E74B4B5D969663E3B52CDA7F9934A6AB93BBAE9BCD1BD39AAAC24FCBA7EC451156
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................L.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-G7ELA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21144
                                              Entropy (8bit):6.936275464847822
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:809FDBD7422A3E02C89244DC530A3367
                                              SHA1:A6999C04B243B034F8EE7AD0D79F3CE24DF9A9D0
                                              SHA-256:C191A43029EDD4EB8EEE003356F1FE79AA45071C25433A7A3589590E9089EED9
                                              SHA-512:5232B7EF2B60A99BE2B027112078A7DEBF58BFA4308F4AE53DD9A96FA7BCCBB0927BEB7148E7A3944173F7820F9F519767539D1FDFEF848B6F1D6668BE11FC15
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................A.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GBL9Q.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.911523435668273
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AB8D293BCD7A13E83565B4AFA8438988
                                              SHA1:48F227C62B2001C441BCBC5B570911F096DDF421
                                              SHA-256:0E80A2E256D16E487BC847D1857ED7CD088F176254BA2A385D675338B836B0FC
                                              SHA-512:443DD75234C043DE736423466C1FC2FF2BD9B6B9FE753521C3C225DE99F5A7D3828A470CF8EA54678A86681949E5DCD1DE1EAB35BF0F348F758FA099A9092F54
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GDD25.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.916807633540711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D9F02D9F7DA653F82E75112A2AB99CE6
                                              SHA1:BBBB4C2C3911AE1F5BA7FAF1D632ED0F14D9B6AC
                                              SHA-256:21493F7F615A099E795F7FAE7ECCE6082414D1D427790BDF4B103623A3AB34EB
                                              SHA-512:DE5546FF103CCC6AA38E254039A372697A193F9C44D0A44F0BE3B242D9EEF63023DC3FD0C6E8E0D2363177F9230A4E7200D4C32591B398269A1CEE9BC47A99FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GNMM8.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22216
                                              Entropy (8bit):6.840714789582829
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:562F67001889CDBC2531947636418EE5
                                              SHA1:B219DD45550762B54DAB46533D489C4755F55E0E
                                              SHA-256:9A8BA725F8E953C933285065228A9409036F9137D03016B127CCEA8A19452466
                                              SHA-512:FDE868018D24FD72177EDE58952325B52561F9D44AE02A4A2268E445F47ABF3B81B809F443D362DF83BD6667B5988AC2CA15242B9F76A0B5FB5B444FADA1BF26
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................0c....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l.......#~..|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-GU2I5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21728
                                              Entropy (8bit):6.856791185052111
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D86B0ACA05321569D9383DC7C4E9E934
                                              SHA1:2EF7D0A222C3A3E564B3C72D5B71A5BE40A7ADEA
                                              SHA-256:28B165CDDB82A2507114394AE398995EF8A50C549214F8678AA66054F6927754
                                              SHA-512:5959E1129C983825233A07869DD1B2B1DB32830D2B5F6B7F8D869C39A76A241F88F76D37341FDFBF56F000FC6ACBA19AEB36A7EFB94721494B41B65BF4978651
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............**... ...@....... ..............................vC....@..................................)..O....@..0................>...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................*......H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HBD8O.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21152
                                              Entropy (8bit):6.8927140284137165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E33930FE2E0867CB1F9FABEDDFBD7B1
                                              SHA1:4D93C7D7E6315CA2195ED73716996ADE8E17FBB2
                                              SHA-256:349C7FBE9AE2B78C2F90239BDDFCEA5B16A0FAAC1FE83553A816C50C3E9089B1
                                              SHA-512:8F87B5013E0CF3A776BFB1F1A68F316A28AF3CB6C74F0ADF3EAD6D5063525C6668B42C077549F66267130959A9CB986BF5F8E4242FC4EF36C356D6927F587A0F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................~.....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HESRK.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):30544
                                              Entropy (8bit):6.684598614993447
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9D9F45B85526E491F6555B1566A41C
                                              SHA1:1420EF91F6E0F6954F373F1AC4079064398AB455
                                              SHA-256:694F4C61B6BAE0AEFAC07A1E861C12C03CB6002F30091E4C8B05BB9C8CCF0D3D
                                              SHA-512:38890886C641D7E6E76A3D4D984215C680F5DCF12129BA2EBD560644EDA793335B01C637C1F6744C249DAB1FEFD5AEB8D1B212475221C03DF3CA82413F6670C0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..*...........I... ...`....... ...............................[....@.................................gI..O....`...............8..P?...........H............................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o....*...0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+*..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..L.......(....~....%-.&~..........s....%.....~....%-.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHT9H.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918387036071988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:51B07204081BDE29A1F84A3B48554186
                                              SHA1:FCA2F72C039937357099CA6E167330E540F8335D
                                              SHA-256:5C84DD40D67C0E59906511D2B09DA8E28C454B5979EB5FDE74213F9D4BDBC564
                                              SHA-512:099EC1B84FCF6BF07142AD8CD34307C80F19A64C754ADE505AB55707075A764FBE7BFA4CE2FBAEAA09B3E61EBDB6E3D116608DF0CF77BC076C7B3119DB37A324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HHV6Q.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.879927360305737
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FBA237EEE9835FA8EF86AF92D9CC8CD2
                                              SHA1:6A0E87137EC33A70763E29AC70FD119EF2AF9CF5
                                              SHA-256:86AD0C89AFBFA047B23427B866141596449F44A89A8748B782D73315A25637CD
                                              SHA-512:6BAAA2CE92E318A12C144C48FFA1C0B8C169A7F6C72C4C7DCA82BABE3F4947685F5EC84E3DB72AA1FC70D27DB5AEFDE20A2F0D22E9DB024290342E98D1D999EA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x............."...0..............<... ...@....@.. ....................................`.................................C<..O....@.. ....................`......x;..8............................................ ............... ..H............text........ ...................... ..`.rsrc... ....@....... ..............@..@.reloc.......`.......(..............@..B................w<......H........&...............................................................0..7.........(....}.......}.......}......|......(...+..|....(....*..0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..*.......(....(....(....o.......r...p.(....(......*....................(....*.0..<.......( ....o!.....{......i(".....o#....{........io#.......&.....*........55......N..}.....{....o$...*.0..G.........(....}.......}.......}.......}.......}......|......(...+..|...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HK51L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):91648
                                              Entropy (8bit):5.476131785053364
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2505206D82B85F5C8658441F0D100CDF
                                              SHA1:685D0A1AB32DF7B012E896F01CA76DDABCF67499
                                              SHA-256:3BC7D23F2F44AB3F7F8FF9E00289B49E6A5E990DA1F8DC92FDB138D6DA16B403
                                              SHA-512:F699F0E997F2F63F4533A0F7D436EEED99490DA7A944A8D99368661A5E8DEA4A5869DD2C3FADFDD8AF76BD97F226D68B6BFD9969DEF3597F340E539C159A1FD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..\..........B{... ........... ...............................b....`..................................z..O...................................8z..8............................................ ............... ..H............text...P[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................"{......H.......\...\....................y......................................2.~....(....*f.(.....s....}......(....*..0..G........o....-..*.(....,..{....,..*.j.+..{......o....o....,..*..jX...o....7..*..0..7........o.......o.....1%~.....o.......+.......(......X....i2.*2.{....o....*..o.....1-.{.....o....&.{.....o.....r...po....,...}....*..r...p( ...,...}.....{.....o....&*6.{....o!...j*....0..W.......~......{....o"....+..o#......r...p($.....o%...-....,..o&.....o.....1....o.....Yo'...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-HM8L4.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):28624
                                              Entropy (8bit):6.700175270481286
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:568B53398BFC0E54AAF448B68F5C77C2
                                              SHA1:76B0B6E65E38A90A4ECDB3F6DFE16D5A803081E9
                                              SHA-256:8BB9D52BA5C67F05C8F632DEB1E7E98A909318B10E1388B47E919515FDD42CBF
                                              SHA-512:6052EE3664FD2095DE3338CF6D24DF022DC13D00B4BF14C57572F2A34AC078E07BD1F634A50028DB0952AE8067FFCF19079177FA534240D9526F33AE1E1459AC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ...............................V....@.................................PE..O....`..x............0...?...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r/..p.(....*......(....*2(.....(....*^~....-.(.........~....*.0..........~..........(.........(....-Y..(!....{/......5..,

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I2HMI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):37752
                                              Entropy (8bit):6.646566139863202
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A890C488CF2ECD406B804E7E3C5B7F0
                                              SHA1:BF2C1287F0EC04223CD17FE20AB2ECFFF18579E3
                                              SHA-256:F17FF442B77A6CFE9C118D2F8FAE1AB6C814A0D4F35C5844996BE84F3FCC8592
                                              SHA-512:4EEC61F9245DFF3D468818D6D6CBB8E12A5172658F1027A9AB0ECE03CC1377499833056A0DD4FF20B83B9FF9E47BB2E7F8DC7B641BC63AD78FF96C54BE01F524
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T..x?...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rK..p.(....*2ry..p.(....*2r...p.(....*2r...p.(....*2rc..p.(....*......(....*..0..;........|....(......./......(....o....s

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I53AF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (550), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):1812
                                              Entropy (8bit):5.2113294172684235
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CACAE3835B5778B23A0A95E634D2BF29
                                              SHA1:5C3CF604C01A92970F12AD796E3CF6758FC98757
                                              SHA-256:1CD3F291E7BFA1BA96E522ECF36E7E849302A7925A106D572A93B9A763072E8A
                                              SHA-512:8DF153A438E0827FCACAE1DC7593667F5BBA80B509C235B55E3572DE48AA284079D70DAAF27C5BCCD97147FE59628A730025CC2EF8E4F4A46DCB274CEB17EDBF
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="Clear.application" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="Clear" asmv2:product="Clear" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="true" mapFileExtensions="true" />.. <compatibleFrameworks xmlns="urn:schemas-microsof

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I7MF9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.879068263314492
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99373AB10858746AAD424F28B48277F5
                                              SHA1:5042EE630A6C7C2986E8323A14D052C1D83B6F61
                                              SHA-256:9C4AE61E0E8365762EFE3D34C5595029F2C12E0079E6070720E2CEF0882C84E5
                                              SHA-512:E96F8FDD6FFB702D344746CE82DE576BBA8636EDE3E39A7DA18CCF8A0178B8346FD31140760B864F1487D7804D931FF1A18DE07A4CAFA0CF79BDB340421FC03F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ..............................mG....@.................................x*..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................*......H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-I8LB6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.863777213641518
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A60084F9988C7907F7092C143C8D3818
                                              SHA1:A69238054BEE26063D32B85B797BC4E0C49F79D4
                                              SHA-256:B755D0B55A465D07C9DD3FC11822487D1E649B684AEF91A4CE9B935B416A01B9
                                              SHA-512:6147F18BD9C49727251CBEA7A3168E3B19F34056DE5A9898571ECDEC85D424627A72968072449C81F97F95330BAED7E2ED0F6FDBA7E2F79B59B9352AB11003CF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IHDF0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24296
                                              Entropy (8bit):6.780229572480669
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7E74EA95786A02687CE43C356ABDC95
                                              SHA1:2E6A3047BD3BCEE01F55D139A3C03E6D4D2DB14A
                                              SHA-256:383A1F9DAC655C6805C24D4A03BC5FBEB9ABD1536DE5510F5756259EEFCB4871
                                              SHA-512:B7E76B65406904F092FE96DED558A94EA53FA40BEC500EFCDCDEBF124921F4526DE2F239CD25BAE1801692DD6DFE5652FFD46B2AA4325133C7127D27F626BB9B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................k....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-IPQI0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.875690583921479
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37E21B63959F243A157534133F85C5AF
                                              SHA1:DFAD52A9990B2FAFCE7098CEBB174927E8E0BA00
                                              SHA-256:4F6A14E4BA2A2B26B8B8433D5F82F75A96AF5A4F036D9447373B07271493917B
                                              SHA-512:F59FAA6319FE2AFEBCCBD643E20C1EDB75DB74E9271354BD86DAC3BEA2CC59452EE024DC26B517AE88254A7C90DBE0E6C19A7B5AB3BFE9159D986D6C53CA5521
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............*... ...@....... ..............................#F....@.................................|*..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-J8HOA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.910097922783346
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:632CC8AD69B76FD9BB5847DE1E1439F7
                                              SHA1:2E32D50EC33EC6635681485B754F4E58D434A5EE
                                              SHA-256:5E61D755616CB10524F5F31E9B70C65A7FFF8E30E25CE711AC8B354D657AB479
                                              SHA-512:9BA5CC82573308E5D995BA05BC660FC1C087EB91D8BD7EFCA6FF838A3C47BD6118D9C92919B2E0DAC11A5A27977318C5C819499DC19CD5D6E57122A0749858C6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`......|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-K7VFE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.827241992748525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C5CADB1409F25B6A1C7A6DD4C2DF236B
                                              SHA1:A994C87352486D433A06943C01329DD721AB343F
                                              SHA-256:F600ACC811720183C639CEBE5618BAF9C8135B85B9CBDC0758BC9B2DCC6DD7A9
                                              SHA-512:6BD6E482533B9FF8FFF8823F84CDE7191A0FD5575F76891A95E99CD1F5C1122EF92B436745EC9583089445FD5EAC795181759080B1D83CCFA1EED31D9CCE3AF0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................`.....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-KSNII.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):17920
                                              Entropy (8bit):5.2867272535707315
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:24A725F929CEA66D043FA85A39228B67
                                              SHA1:2B874371B1705DB4434FCBFCA03F8AF57B36F2B5
                                              SHA-256:6E4B9D12FFA3AB66D6B913974F44A969031781FB82BB0921391A00C4D18F85AE
                                              SHA-512:654459CE76374C70017D51D1A1894D369EA9427B7700A91889C0989627056816926DB8F60B971DC4DE3BCDFC8BC09BA9E3615BDC1C9B8AE0BC495A47DF17B28E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0..<...........Z... ...`....... ....................................@..................................Y..O....`...............................X..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B.................Y......H........1..P'............................................................{....*..{....*..{....*..{....*..(......}......}......}.......}....*....0..q........u........d.,_(.....{.....{....o....,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o ...*.*.*....0..b....... F.5k )UU.Z(.....{....o!...X )UU.Z(.....{....o"...X )UU.Z(.....{....o#...X )UU.Z(.....{....o$...X*...0...........r...p......%..{.......%q.........-.&.+.......o%....%..{.......%q.........-.&.+.....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-KVPU7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1091
                                              Entropy (8bit):5.422867818033837
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B7C72A299A37A2C1DFBA450EA4DA1C0
                                              SHA1:E1470C1F3DFA59BE0284703594116475FECC04F5
                                              SHA-256:BB9E8767511EE15BC7F10DEC46C127B486D3BBE4794298D7E259CE30F79EF790
                                              SHA-512:8B7AE4F307FD3D644F9364137C7358DFF156580B9483C67191E78627FF8CCAF27C6829D385D38647F853CC6E2CD6615887E4361B8A4299CF216848D899724E84
                                              Malicious:false
                                              Preview:{.. "ThankYouPageUrl": "https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid={guid}&ext.id={profile.BrandName}&ext.version={app.version}",.. "FirstRunUrl": "https://clearbar.app/rd2/?id=382844Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "ContentLinkUrl": "https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "UnInstallUrl": "https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "SearchUrl": "https://search.clearbar.app/crx/search.php?guid={guid}&q={searchTerms}",.. "HomePageUrl": "https://search.clearbar.app/crx/search.php?guid={guid}",.. "SuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}&output=json",.. "ChromiumSuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}",.. "BrandName": "ERS_ClearBar",.. "FeatureUrls": {.. "weather": "https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203061_{user.InstallTime|format_mmddyy}",.. "app-icon": "https://search.yahoo.com?fr=tightropetb&type=11745",.. "maps": "http

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-L44T9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.917303618941186
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FDB3A743B2DAE5924CBA88A5C865128D
                                              SHA1:C53132EC95A7211C1BB6DCD5AD21CCB150A7B923
                                              SHA-256:9D4FAEA9892D4ECFABF61986687FC6CB30F5F51A6B62819B9571FF58E04C4DD5
                                              SHA-512:CBD8370F3CB84CB9EB8BF3A7392245D6A90CE1A324971EA96170974DA092BDFC3DB2196F66958CA5D5000F13B18AFAB44FF82D50C5B9A625AA1B7A4AF17717DE
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LJTH0.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.924980445039345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65FBBA7A86B3E175200AE44727AB40E5
                                              SHA1:584B8683943A8E0AE98B10F452C94F6109D1C4EA
                                              SHA-256:7A81D2A001B543B2A55C9AFFC845A5DF7EDAB1FD308C6979BBD982B1B826B57C
                                              SHA-512:43607AEBBB0A3F2D437C7DE77785CD6C9F49411E1D4EFE41ECCD93D7FCCA197DABD4E15F45FBC4FBFF27C202FEC96B79F82202AFC88B59C20ED5E7912BCDC6D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...............................d....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..................................................*.....*...c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LPSKV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):29360
                                              Entropy (8bit):6.504362287456874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0E35085C130D2D91E5241334BE7EF0DA
                                              SHA1:FD622ADE5CAE26353A22B6FA50A83669B72B6C41
                                              SHA-256:50AD612D4CF6113DE26B2870DA099C4817F59E64A2DA98F05803B4A2E2304919
                                              SHA-512:2498811F4AAC308CDC55C3406BEA4FEF5DC9E6F23559B09FB181F7447474EF586F00038282DDC39C241490B5DC2BCA7F41F19BD3E1BB00890DA29DF6489BB151
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..*.........."H... ...`....... ..............................7.....@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8...*.8.....8.....8.....8.....8.....8.........*.8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-LTI51.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.898006718463938
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6CCCA0BA6A7B9CAF8B8D3B0287DBED8B
                                              SHA1:B81FF87B407578EFBF184BDC10D0F101610379DB
                                              SHA-256:16E7EFD6C19B2E3E516AE1BC7B3175D0E22F1AD357701F229E353DA348EEE182
                                              SHA-512:8505479031A0A5CAEEEE1A8A60AA35D7E0C332BBFDDE61193B615E242C127780E55F404289F26930E9EC9E53FCCF436B1A991BA2C8A9177163B41AAAF6BE0D32
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MJB0T.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25992
                                              Entropy (8bit):6.72175242984799
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7C93DE0627833900B8379FD181B7351
                                              SHA1:2CB98F9622F57A0A9E037A378519AA6A271302F6
                                              SHA-256:C7E91BD148ED22EE1FF8EBD3E58B199A30AF90AA37499BCF8DA34409672F2ED9
                                              SHA-512:1067BACC4495EACBC27937B54780B97DA62FED1AF66158E2FA492FC82B068D49BB49BC20C3C82C22D8EDD300BD7B097E14AA1E317F1789744E188BCA15D22B4D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................x....@.................................a6..O....@...............&...?...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o....*"..o....*..o....*"..o....*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*...0..K........-.r1..ps....z. ...@3.(....*. ....3.(....*. ...._,.(....rI..ps..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MKAC5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):26752
                                              Entropy (8bit):6.512503595653532
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:970B6E6478AE3AB699F277D77DE0CD19
                                              SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                              SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                              SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MOF23.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):162448
                                              Entropy (8bit):6.204693784639812
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:805135DA62C5B65618B9782A5DC48F06
                                              SHA1:4F074C676E8A93EA4E618DB0E2AF4D5D2463AC17
                                              SHA-256:A0B5BE9580BF6548F685D79E5439F6D946EF57E013D201F946B2A894E7441804
                                              SHA-512:8594AEF25DB9E73DBAD999F6E4CBFE548FA82E41D94C6396F51213809BAB01B043C1238171CD44FC962E0F53050E4067A449AEEC07FD23B511A1003E71E2BB65
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....G..........." ..0..F...........e... ........... ....................................`.................................Qe..O.......p............P...*..........\d..T............................................ ............... ..H............text....E... ...F.................. ..`.rsrc...p............H..............@..@.reloc...............N..............@..B.................e......H.......l...p....................c........................................(*...*..(*...*^.(*......d...%...}....*:.(*.....}....*:.(*.....}....*V!..R{*....s+........*..{....*"..}....*....0..Z........(....o,...-.r...ps-...zs0.....(....o.....+..o/.....o+....o5...o0....o....-....,..o......*........*.$N......J.s1...}.....(2...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*6.|.....(I...*..{....*"..}....*..{....*"..}....*V.(....-.r...p*.(....*..(J...%.(....o>...%.(....o@

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-MRCU1.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):5407792
                                              Entropy (8bit):7.269144159853683
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:26AE5F1918D76D1221ED90C7183BDC84
                                              SHA1:404517A0671B41212A9332A195F339BA8E8355E6
                                              SHA-256:F685D405EE59002A2A8A08D98E129322ACCBB0C48153E19E4E1127A583E4BCFB
                                              SHA-512:0B33B03D4EF15653E3F0968D0F791306EA9342F4CAF0CAA9FB95C60799D4E37066DA335E6430B2B0C65BF9C91AB7C855CD6D69517B5DC2B303EA574000ADBC2E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t............"...0...Q..~......F.Q.. ....R...@.. ........................R.......R...`...................................Q.O.....R..z...........\R.0(....R.....H.Q.8............................................ ............... ..H............text...T.Q.. ....Q................. ..`.rsrc....z....R..|....Q.............@..@.reloc........R......ZR.............@..B................'.Q.....H...........d...............P^J...........................................{;...*..{<...*..{=...*..{>...*..{?...*..(@.....};.....}<.....}=......}>......}?...*....0...........u........|.,w(A....{;....{;...oB...,_(C....{<....{<...oD...,G(E....{=....{=...oF...,/(G....{>....{>...oH...,.(I....{?....{?...oJ...*.*.*....0..y....... ..a. )UU.Z(A....{;...oK...X )UU.Z(C....{<...oL...X )UU.Z(E....{=...oM...X )UU.Z(G....{>...oN...X )UU.Z(I....{?...oO...X*....0...........r...p......%..{;...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-N3995.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.91070814532456
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E06BAE626965FBDB0BAE5437498B5155
                                              SHA1:49392F58BE6F5C97C5DE59BFC44F9CFCBE1E5DD7
                                              SHA-256:19766A20B62B038ABC3E863F2D6E7B55FABEE4D9CBCAD3EB1D7BD3EBFE8D023A
                                              SHA-512:69C6D8D5F8835DA31D36940F0AE793BD00D87E9CB9380C3A7B21FE3E315F192F95B8E63C8F9D0A3737C73673A0AEAC41FC728FB7B236F12453A953066F9E53E7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................|(..O....@..@................>...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-NFO05.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.952743264834991
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7D317D88F9860A18ECF7FB90B33995D3
                                              SHA1:C2E4B19CB9A0B48E899512CD121FFE6657D41072
                                              SHA-256:C98A52BD017DF01AEA7B955E6F219537D391A62C2C2B976684DA282F9CD7CACF
                                              SHA-512:79ED01C6D1CEA3DBA6B3566E03D05A971745E221BE9330F6800A249D1B239E092D3FF704E7403E7ECD6B7709B24B0CDD7E518F2EE5DA38019E7139D80594173E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................Y....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-O56GI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21752
                                              Entropy (8bit):6.916008128976572
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F39655CCFC010E32A7240D9BF5D0852
                                              SHA1:20AEAED12DFB8D71E39687350EB12BC0DE372AF0
                                              SHA-256:BFCD867F71C887429DFE008D7EC5D1853D15B3932D4CE8991694293477B5BE37
                                              SHA-512:9769E59279A32F29C2F2C6970C81D3ED76FE3421B819DDFFC8FA98329F1B45300C737FDF71956672F80F69B3A75727D184F8C421E00B84E94163A86CB744A991
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ...................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-OFPQN.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22784
                                              Entropy (8bit):6.859096700065679
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1699287934DA769FC31E07F80762511
                                              SHA1:BFE2384A92B385665689AD5A72F23ABC8C022D82
                                              SHA-256:0DBB92ECD5DFA7FC258BC6DEED4CECF1B37F895457FD06976496926ABDB317BB
                                              SHA-512:4FEF3E1535F546FFDDE0683F32A069BEEFFE89096524C7068F1F5CE8377824F82AE530D3990C9DD51BCCAA9E53FDED5613FA1174013325808059276DEE771187
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................:.....@................................../..O....@..p................?...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-P1KJV.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21768
                                              Entropy (8bit):6.880530414500754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6067ECBAB3C6DDDB6BF7C49C7948CAA8
                                              SHA1:5F3DA777AF01DBC159BD8D9D97D5DC105918AFC5
                                              SHA-256:22108E32E0B6E42F5F52A4CB17B9B6FA3DFD547ECD9EEF9C67226DBEC54D23E5
                                              SHA-512:9F3E834B8342E0C7AA5CCC993B520D664B03F1F0091066C66067923E1D4991EFA03F63908552538C05F423AA2B696DE7C76993F71A7564F3E87662CB0FC00726
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$*......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PCCLC.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918416126337718
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FCB2158FC41D97E2BB71953664B99B9
                                              SHA1:16EB49AFCA84C9E6160B4E5B36F1EC5C98470C86
                                              SHA-256:984575C44CAB17D46587AF6CC8C22C409B79BEC280FD771E6AF93A0A0C20E5B0
                                              SHA-512:1527A426F8EC9931573468929966E102012B630EC4AA370C196B2B87472BCEE696B00355ADAEB39B4151B986470F7DADA415E3F930D9678B68D3C531C8AC9B52
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PJDAA.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.909892409390874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D74405753F829E75E89BBA5EBC296112
                                              SHA1:474944856DB781A34796BFCCE18ECD4580275AD1
                                              SHA-256:86F1F12E47F260985B08BB966598123578EB5E48BEF9BB086F04E16E9D53BB32
                                              SHA-512:CDC5D49FCF0249C539E45C9917C152F130C8FEE975D97C2F62526F474CB779B2BF273195F4AA7A64F76DD2496528C0D021B56E60AAE2635606F9F55092CB47F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1W....@.................................l(..O....@..P................>...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PO9RP.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):701992
                                              Entropy (8bit):5.940787194132384
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:081D9558BBB7ADCE142DA153B2D5577A
                                              SHA1:7D0AD03FBDA1C24F883116B940717E596073AE96
                                              SHA-256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
                                              SHA-512:2FDF035661F349206F58EA1FEED8805B7F9517A21F9C113E7301C69DE160F184C774350A12A710046E3FF6BAA37345D319B6F47FD24FBBA4E042D54014BEE511
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ..............................*^....`.....................................O.......................(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{]...*..{_.......-..*...0...........-.r...ps....z.o......-.~....*.~....X...+....b..

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PQ410.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.848992181946284
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1D8AAFECA1EA565B257384D3F64864B0
                                              SHA1:4D923B100142AFA2E0A8B7ACDB3A6DE6FEB91148
                                              SHA-256:C2250E9E51B44D8AB8C5B892592766925F6580EE00B95026621D0AFB037C2707
                                              SHA-512:99E4A226E1FABB348E7EF7C6FA56AD0CE4E4CF5D8569CE21881703DCA8D83A1C113FD5F440A4FC9E9B99A04AE8CF4490E17D62FFC09CFAC5A45678A4419EFDBB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............*... ...@....... ..............................J.....@..................................*..O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..|....................(......................................BSJB............v4.0.30319......l.......#~..|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k...........*...0.*...M.*.....*.....*.....*.....*.....*.....#.....*.....x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-PT87J.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):113152
                                              Entropy (8bit):5.967666840143916
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72D4D1734FE9492F8507219FD9D8DC64
                                              SHA1:970E9CED151576D9F8D7E52AA0F312A0059002DA
                                              SHA-256:986F96B0774CCE5A3A4389BC5E3D8C9B7A69D107B7DAA47607CCC41E20EA217F
                                              SHA-512:8E0E4B29D88ABE82CF856D9AC940A64BEAAF354A8E901ABF53A52C579E51D9BC969322E3CE3A6ABF8C7B45A73BD2BE41C74EC9E120B895D305308D6A3927E237
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*n7..........." ..0.............F.... ........... ....................... ...... .....`.....................................O...................................(...8............................................ ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................%.......H.......D................................................................0...........-.~5...*.o6...9.....o7...o8.....(9....... :..B...... .k[c5[.. _..,5).. '..;...... W..#;...... _..,;....8j..... ..K;...... 1H.L;...... .k[c;T...8A..... .n.w5).. ...l;...... ~LUo;T..... .n.w;....8...... ..B.5... ..P.;...... ..B.;....8...... i...;...... :..;]...8...... 8`..5u.. ...5).. .K..;...... .r.;...... ...;....8...... )..5... ~.d.;...... )..;....8k..... BB..;...... 8`..;....8N....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R43LO.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21160
                                              Entropy (8bit):6.908265030965905
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA9376C17EE0148F0503028AD4501A92
                                              SHA1:9D5686CBF45E90DF5E11D87E7B90173A1A64B1A0
                                              SHA-256:B537313413F80105F143CC144FEEAE2AC93F44747727DE309A71D57D2650034A
                                              SHA-512:18D1BB2D5C469644078D75766DBF04ADDF7D0C543F7ED15FF522CEEAEF960900DD8EC68172F5D684B76B0AA6946BB38D641F021EC04C70AD66A6062C10412E0A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ...............................U....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R6FTJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):97280
                                              Entropy (8bit):7.267366315163259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37391572EFAD4B7DF720123D7A35EA6
                                              SHA1:512B4EF31601998E3749223E067A96C95E3E3F78
                                              SHA-256:6B7A81F9A501F36FE050D94E57DC7456B1C63C58BFB214863FE9748A2A22D146
                                              SHA-512:6866D4995499ACF40D6102B2BDAB27B951879523B2FCDC61C40793811B1CED7130DAC2C9CB5B865268E8C4B2FA28AC5F92E4B4AEA81833A7AA262DE75B4AE68D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..p.............. ........... ...............................T....`.....................................O.......................................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R70VF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):98616
                                              Entropy (8bit):5.627990537858435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0ADF6F32F4D14F9B0BE9AA94F7EFB279
                                              SHA1:68E1AF02CDDD57B5581708984C2B4A35074982A3
                                              SHA-256:8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
                                              SHA-512:F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M...*.M...*.M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-R83ND.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.93694523950017
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E2239979B853157BA75310FEA7E65D
                                              SHA1:EE1AE416570911282ABDD3745674E58F9D469C9E
                                              SHA-256:E8D531F0AAA674F794B7F43EC76E4E32AD93F3C136020CF4B6E3433832F9C0DF
                                              SHA-512:DDF9D6E05D9566C9E02295A061756FF164C408EA211D016023EDBFA91BBA4D0D7DFF293D2BF4D87C25FE923500C7535E4A21B6A8D4B18FD9505F8E5C635F9C95
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................#....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RCDHE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22904
                                              Entropy (8bit):6.8552351968066105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A5F541655A9EDC24F4B5184A40E40227
                                              SHA1:90E196DCD76168F770ABE30098399BC5866ADF1B
                                              SHA-256:B33D08149A756A401628D11BFDDFEEACA1F03C0578395BB061DAE44F8A12CE5D
                                              SHA-512:C4D13E95114E232300B36ED7B7A72CE786F66D0F68B0ED9D54FEF788A831B39C893DAA3C2DE982B376A56A539C23E8F314CE8552ED7094E6826D5F70BFBE2D4B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ...............................+....@.................................z+..O....@..x...............x?...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P*........................................s....*:.(......}....*2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RE807.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.900655456226697
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:76B8D417C2F6416FA81EACC45977CEA2
                                              SHA1:7B249C6390DFC90EF33F9A697174E363080091EF
                                              SHA-256:5EAA2E82A26B0B302280D08F54DC9DA25165DD0E286BE52440A271285D63F695
                                              SHA-512:3B510CDC45C94BE383C91687C2CB01A501BA34E3FBB66346214FC576D6F0E63C77D1D09C6419FC907F5B083387A7046C0670377AD2E00C3EC2E731275739F9C7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-RNFKH.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.952503401221548
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:34E21101FAF71A27C6819CC051DEBC9D
                                              SHA1:D9DF77B4993418337894FF04C6B813224B9F8543
                                              SHA-256:81B6527AC2D18782AC24AE463C11DD1D70AB1BC89F626B7347A592229B371A1D
                                              SHA-512:AA339F2489CA9BC9EF7F6121C9586DBD8F5AD2CA5A160A3BCAC74B908570EC2FC0BC24E0EC33AE9DE9D6A6C3557EC2816FE8E89FFCA93E310503F6F83A691F6D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................!.....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S6HAT.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21264
                                              Entropy (8bit):6.950539566613158
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A42C32F4E98A9656FC2FED72D30E9380
                                              SHA1:B6B8986FC1B5140817DE262AE4102499E37DAFFD
                                              SHA-256:C343F7BF08A4C97A90BA607A492C721533333173FA63F65F6E5DE9CEEE65FC16
                                              SHA-512:5C2DE8F18CB9B367D7DE88A2AF8A7FD538486B9FFB393972FBDFF42CD2899D6679FD8D7076FE37954D5E8EAB6C5041F19EDAD32659C5CCEEC1C2BA35E6F8982A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................|)..O....@...................?...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-S7D15.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897645601910542
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F1CC91D25B52C7504DC5BEAB5D0F498C
                                              SHA1:498F0FBBD2712F4F637BDB7370B2302FCC4966F3
                                              SHA-256:E3036362506D96C9C00ED6393A2AFCACD9F2E71CD2A35C1D638A61E85D2FB040
                                              SHA-512:4C931389035DF21AE67810D8C8E95CB613D9495E2392B11E34D84F624F90C78C541B14FB0D6FE7F0F89799AAD4B34E91FB6F73978AE38231840F047915E6EB5B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................q....@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SNP6L.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.939816403058967
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:45FF71114047DBF934C90E17677FA994
                                              SHA1:526C688E71A7D7410007AD5AA6EA8B83CACE76C5
                                              SHA-256:529943C0CDF24F57E94BF03FAC5F40B94A638625027A02DF79E1E8CB5D9BC696
                                              SHA-512:29684AC5391268EAA276196A6249364F6D23ABFE59BDC304A561CF326CEA6CD662FA04C05E15924FD6D3F9E9D1607992B8DCAD3F817CFE891580F9D9462FE9B7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................>....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-SR0IF.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):229376
                                              Entropy (8bit):6.015136394443516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:57CDABE8A4465F184EE7C9F00F796996
                                              SHA1:27C70AF6271700FB3F84616C9EBEA155ABCB0604
                                              SHA-256:0712A1E8E2A9887DB18439DC3F3FDD6F8B367F514A47FB70A38FD6121C388E02
                                              SHA-512:BABDA13B581C9B09ED70C59C89C6F59C951F3B7F85D915702B47D3C7DDB7179B6C799BCB445A4E08C64977B047630EF465F77A1EC5DDE6D0D8385582B58B5622
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..v............... ........... ..............................eD....`.................................Q...O.......................................8............................................ ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B........................H...........L...........P...............................................2.~....(....*:.(......(....*..{....*..~....}.....(....-..(....,...}....*.s....*..0...........r...p(5....~....}.....o.....3 .o ...~.....{!...("...,..o#...,.*.r...po$.....(....-"..(.............o%....{!...("...-t*.o.....3H.o ...r...p.{!...("...,R.r+..po$...r5..p.{!...("...,5..r[..po$...}....+".o......3..o ...~.....{!...("...-..o&...-.*..0..M........rg..p(5....~....o'....r...p.(.............o%...o(....r5..p.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T0A69.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21248
                                              Entropy (8bit):6.908174280383857
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0D9A641105098D642567B22101A4DE0B
                                              SHA1:12419C25D1C2EB706A4E4E649EE353CEDA7446A9
                                              SHA-256:7C25A74772E135257235640A0264DDC05235E14F3627896CFE735E9955155F83
                                              SHA-512:FD4560CDF01DE237DDF797A33C5DBC220D3FCAE07EDE17D43C39F5562E36E03646676A87E20699D7603FCA6D84F66C8756EB863DD4727B7E1A499619BB88DDE1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................@.....@.................................H(..O....@..p................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-T78L9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.866908604521752
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BB1A520F25BB93ACE4DD0A060FBA677D
                                              SHA1:92BF07CCF32EB9FDF06F446A256E0271C4028BF0
                                              SHA-256:7720EE13405EA8A3C204703A181E67DC6D66835E9DF263C09D04D8B48B41EB26
                                              SHA-512:9288148EC879EBEAFD53C225854EE3BD3768BA5C7B829D6AF1251D20AC301FC27A04BEBB603FE2CDE6949BC5968FDE717E8B747337C1AD872450D26F7C36F515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................'.....@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TA0F6.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.904224159979604
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05D1B950C470EA8B0AA357F9A59CF264
                                              SHA1:B1756DC750ED5CFD5D0BFC70CB899FD590867A0C
                                              SHA-256:DAAABD07F1B94BE19D72913360286E469F454886850AFCC603506EAAB03150E4
                                              SHA-512:8E65FF1909AC8D65F599062E61AC935A919D43404C357DBC6AD628923B0C7ED7158862DDD272CFC1C2A8CEC393D48A57BC4D69CE7706EEF1BB6838826B1AFAE3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQ5MQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):4608
                                              Entropy (8bit):3.936494912616784
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B7BA072AAEC4A86B5BD427DA28A51AE
                                              SHA1:FCD78D6A109703EB6C691263ADE979ECDC68CA46
                                              SHA-256:3B5E5FA773FD749C1429E56FC252DB0919BC698BD3084AF58760AAEE097DDA88
                                              SHA-512:DE6AB6B23AA81A2833E452059D373E321C9F121B82CBC330F3D726BC3828424D4C0B1E9F83D8124825A8A0E71F386C3A3D1BE4C3A35EC6189E4C3BA52FCD4CE4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8V............" ..0.............J)... ...@....... ....................................`..................................(..O....@.......................`......0(..8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................))......H.......P ..............................................................BSJB............v4.0.30319......l.......#~......0...#Strings....0.......#US.4.......#GUID...D.......#Blob...........W..........3......................................................K.........j.............................M...........................................................'.^.......................A.........'.............\.......................V...q.V...q.......................n.t...............

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQJI7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.942827969586567
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B52C339601CB264F83DF72D802E98687
                                              SHA1:8BBB7BADAAA912C1F17775E9ACDCAB389704C772
                                              SHA-256:938DA38561DA54793944E95E94B6E11CF83AACD667487297D428FBCE1C06DC9C
                                              SHA-512:287F08AB07827570F9F3EF48A6D7E5C186899A2704FB3DBAF36975F6BE7B29FB6695A69FAB85A6F09BDDEFB60C79052C3A33CF862651F892EB9D773D880B3AF8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................>...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-TQS09.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.934271103866825
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:58A2E5AC0510B9223236B9317C505B58
                                              SHA1:A00954217CA326C54A863D451820263A6D7EE1AF
                                              SHA-256:80A229B2917FC3A5D941FF9745A6BE0065028AFDF9509300410D2721C71F1198
                                              SHA-512:18736ECFE0EF0C477BF64F89CA97AF4578DEFC996F0A5BAD33D7A29AF6E09745E4B10D6D543243B9664E40169EE550C996E783C5FFBB0FC767DA7FFC63E13FB6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................P.....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UGLPU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.926543977764199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9E71DFCE86F14BEEB8F3E9F00D0A472E
                                              SHA1:BF83A7E98418BDE907DEAE8C0C0F3FB0F6C9DB1A
                                              SHA-256:62DCE4679E33C079E11F41B096BC803B30B1D963A1EA79EFA84187CEBBC06AFE
                                              SHA-512:FF8CDC0287E510F859F46C1E35F9B0FB42EAD907B1EAA42C90C84B31CF6C2D4638CF682777F359B8611DD22062C1A5FA71F7FB667B7A3903783673E678098515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UJRG2.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.911906528800318
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DEFAADD4A92D4D348B0827AB8159D2FE
                                              SHA1:F3BD9B4108ACD42ABFB99A3A4760BFFCB84F6C28
                                              SHA-256:3D2551D6458B84566025FDDFE5DAD479CAB5785428EFD6814860D36AD1811C9A
                                              SHA-512:1B13C70F05D56871008D5C8752BC93C8FB590D5F89B4E97264F592CDFD772CBBCCE8380D255F8BB305BC25BCDDEA21E422617FA614DFFD3DDCC9A1D4BE6C54A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UK4HH.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.9502839815242545
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3772A3A7E55178EC90ECB607ABA28511
                                              SHA1:68C240D1A43DE1678EF13107B9300C544E9D5E4E
                                              SHA-256:C9E2562F1A1B86ACDB6957CF916ACED9C4F8B71EBB16DFA0050252146205AD37
                                              SHA-512:245F12B4926114EBDB39A54628A1DF2501C4A27ABD531172CC63BC96298EE0F4BE5658AE95FE730C063EADFB1B664C7D201C69C2246CFBA23ED5A4FE7EF3D14E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UL8PG.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.950543834803339
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:415E3AB72F17F10D646B3E2C7A76F612
                                              SHA1:ED25E94D4E88293345A0F28A5B975159C393B050
                                              SHA-256:24DAA1FAEE0478BA58FEBE8EE789EB88BE0A14D350B57AD8B10690C55976B2E1
                                              SHA-512:55B5C22B87F21DF89D0514AE05C9433B65A3C7532845FDFC4C2C5C5E2C3929D70143D84698FDB4DC13EC01895B1022CF0E5E76E12102739530B54150932A7B07
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................x.....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-UM03N.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):88192
                                              Entropy (8bit):6.25584016939133
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4186A905DC180A0CC2110403727BD792
                                              SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                              SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                              SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VJNDQ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.854915516686979
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0AD301EE2B7282B87DCD0D862EFE14DC
                                              SHA1:F720109A38846E358BDE7C47D9C946A79D2B6B1C
                                              SHA-256:0110616DFE870B8BCF25DF8F6CE38EF5AAC39E728DDAA3420EA199F5A7E80A16
                                              SHA-512:C66FC92435C399804D8A8C1C836E5648725DDA8A55D7ACD897AE719CA231D89251A0D9A293A67F079E345709CFDA83DCC693AD41A28D13661A55459F94FE33E0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................k.....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\is-VR258.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21720
                                              Entropy (8bit):6.851248273705748
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0346A4C5FA0FAC135509A0E7D3C4449
                                              SHA1:7D71B46BB9A28289384AA1EDF5CB03D64B3BCFF0
                                              SHA-256:F9FEB277F86241F55425182A26DECF50A210675D4F040EC542AF3FB3DD287DE6
                                              SHA-512:916A465236F11FF6E421800961B20CB80A320176DA8C58002F6742040CE33C5207D378667A584C5D8E35CF8CFC19AC54504B3F6129E489EEABD86A5B4E7D8C77
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............*... ...@....... ...............................Y....@..................................)..O....@.. ................>...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................|.....|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.368637490829895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1C331DA4BCE2809E16913C02E385576E
                                              SHA1:CF8E71E030347749596A53D1B13B9E9583EC0527
                                              SHA-256:1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
                                              SHA-512:2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\it\is-07PID.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.368637490829895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1C331DA4BCE2809E16913C02E385576E
                                              SHA1:CF8E71E030347749596A53D1B13B9E9583EC0527
                                              SHA-256:1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
                                              SHA-512:2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\app.3f57d9f7.js (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\app.3f57d9f7.js.map (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\chunk-vendors.f61cf75b.js (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\chunk-vendors.f61cf75b.js.map (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\is-5C0OE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\is-5URJI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\is-IL6EM.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\js\is-M1SGU.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\netstandard.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):98616
                                              Entropy (8bit):5.627990537858435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0ADF6F32F4D14F9B0BE9AA94F7EFB279
                                              SHA1:68E1AF02CDDD57B5581708984C2B4A35074982A3
                                              SHA-256:8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
                                              SHA-512:F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M...*.M...*.M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.594776627495051
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B60817A69E314B22F746917C826DA53E
                                              SHA1:7D2785A6D1A53A0717C986B959AF67DE6F9300E4
                                              SHA-256:6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
                                              SHA-512:9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\pl\is-JKUT7.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.594776627495051
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B60817A69E314B22F746917C826DA53E
                                              SHA1:7D2785A6D1A53A0717C986B959AF67DE6F9300E4
                                              SHA-256:6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
                                              SHA-512:9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.846136752240531
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DADE13E423762BDAE745D57CA3DC86EF
                                              SHA1:7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
                                              SHA-256:1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
                                              SHA-512:77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\ru\is-OPN3R.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.846136752240531
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DADE13E423762BDAE745D57CA3DC86EF
                                              SHA1:7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
                                              SHA-256:1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
                                              SHA-512:77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\SQLite.Interop.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1784736
                                              Entropy (8bit):6.555430781989463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1288823E8E1FCA09BB490CE46988188D
                                              SHA1:B07FE4A5D032296E3A7D0727216AF8C1D2166E91
                                              SHA-256:6514973856D1767CCB375DCB253400E710FB4F91FEB758041D8DEFE92B1886C5
                                              SHA-512:88967F64116951092A54118055EAB462082F16676EA7565F42515E88765813B53CDFBBA5181318E73B668E04DDD030A0BFCF5CF47936772F68DF85488B865ACD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..;...;...;...!./...#...."......D..<....D.......D..+.......3...%HC.8...;......D..:...D..:...D/.:...D..:...Rich;...........................PE..d......b.........." .....@...................................................P...........`..........................................J.......b..x.... ..........l........I...0..`......p...........................P................P...............................text...@>.......@.................. ..`.rdata..."...P...$...D..............@..@.data....`.......J...h..............@....pdata..l...........................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x64\is-NUUK3.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1784736
                                              Entropy (8bit):6.555430781989463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1288823E8E1FCA09BB490CE46988188D
                                              SHA1:B07FE4A5D032296E3A7D0727216AF8C1D2166E91
                                              SHA-256:6514973856D1767CCB375DCB253400E710FB4F91FEB758041D8DEFE92B1886C5
                                              SHA-512:88967F64116951092A54118055EAB462082F16676EA7565F42515E88765813B53CDFBBA5181318E73B668E04DDD030A0BFCF5CF47936772F68DF85488B865ACD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..;...;...;...!./...#...."......D..<....D.......D..+.......3...%HC.8...;......D..:...D..:...D/.:...D..:...Rich;...........................PE..d......b.........." .....@...................................................P...........`..........................................J.......b..x.... ..........l........I...0..`......p...........................P................P...............................text...@>.......@.................. ..`.rdata..."...P...$...D..............@..@.data....`.......J...h..............@....pdata..l...........................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\SQLite.Interop.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392544
                                              Entropy (8bit):6.788598919509379
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B68A8D0393FBCE1976C19107422F097
                                              SHA1:B645FC9AFF04F1DE9D31D4C4B965AE0A1E3549D0
                                              SHA-256:F16DEA838EFC5B074F8D8B2F8E14AB77EC744648B1D5DD550456C2F99C12BBDC
                                              SHA-512:7989B760012FCAB665591C2528D8ECAEAD09CD9CD74A7208EF6177B36581D381574D007A31BB4C55DA7BC793000BF71BE546B1CAEC59C380AB8962EA2B719933
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.............jO......jO..^...jO............................,..................F...I.......I.......L.......I.......Rich............................PE..L......b...........!.........L...............................................@......J.....@......................... "..L...l:..x........................I..............p...............................@...............@............................text............................... ..`.rdata..~...........................@..@.data...X9...P...,...2..............@....gfids...............^..............@..@.rsrc................`..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\x86\is-0JKHJ.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392544
                                              Entropy (8bit):6.788598919509379
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B68A8D0393FBCE1976C19107422F097
                                              SHA1:B645FC9AFF04F1DE9D31D4C4B965AE0A1E3549D0
                                              SHA-256:F16DEA838EFC5B074F8D8B2F8E14AB77EC744648B1D5DD550456C2F99C12BBDC
                                              SHA-512:7989B760012FCAB665591C2528D8ECAEAD09CD9CD74A7208EF6177B36581D381574D007A31BB4C55DA7BC793000BF71BE546B1CAEC59C380AB8962EA2B719933
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.............jO......jO..^...jO............................,..................F...I.......I.......L.......I.......Rich............................PE..L......b...........!.........L...............................................@......J.....@......................... "..L...l:..x........................I..............p...............................@...............@............................text............................... ..`.rdata..~...........................@..@.data...X9...P...,...2..............@....gfids...............^..............@..@.rsrc................`..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.701646036890297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3CEFEC17BAAC089C54C8102A4CFD160C
                                              SHA1:A54CD9BD4181A591937A99BE88BEB006279837DE
                                              SHA-256:AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
                                              SHA-512:2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-CN\is-CJS2F.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.701646036890297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3CEFEC17BAAC089C54C8102A4CFD160C
                                              SHA1:A54CD9BD4181A591937A99BE88BEB006279837DE
                                              SHA-256:AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
                                              SHA-512:2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.728551774224484
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:833F269BA6F0C34F49273DA7FBD7DCE7
                                              SHA1:D0253D322DCDF7F54E37C7E8911A8B77670D2967
                                              SHA-256:F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
                                              SHA-512:4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\zh-Hant\is-NMB8V.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.728551774224484
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:833F269BA6F0C34F49273DA7FBD7DCE7
                                              SHA1:D0253D322DCDF7F54E37C7E8911A8B77670D2967
                                              SHA-256:F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
                                              SHA-512:4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Programs\Clear\is-KSDTH.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):3149872
                                              Entropy (8bit):6.376122605923394
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C76E26901E5B975415817DC6691B10FC
                                              SHA1:D11283E30BFACABF622259C169E0DD7424AA882D
                                              SHA-256:9801DE2908996B63652A917F25CD28DBD3FF3E0A5DD1E872320C2E1B724CCE03
                                              SHA-512:6FC7F516F3D0BECFD2C8F564DAE4C9A6E09A5DC6ABABB1CD6AD0F1E6EFF3A50184BA55C3B91110FC0A621E1C781BF814177A3799A806031121884DCB8F95A9EB
                                              Malicious:false
                                              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................0.....qf0...@......@....................-.......-..9..................../.0(....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\unins000.dat

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:InnoSetup Log Clear {D5806CCB-8635-4E7A-94FC-BF2723167477}, version 0x418, 186939 bytes, 226546\37\user, C:\Users\user\AppData\Local\Programs\
                                              Category:dropped
                                              Size (bytes):186939
                                              Entropy (8bit):3.835103681781707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:49BC21A6383DDB5C843F99E46E7D8F05
                                              SHA1:954F59B9D710FB08DB5084610785309245EDBCE1
                                              SHA-256:B92EBFC74B226655D1FF5F5E0E4166DA60B438929F0378E3EF8C02F901BCF67F
                                              SHA-512:6F20935C004F13D333091920D15C274DA5850E451EC47ECD9299A3B3BFF26B5C21DF79EEFC8315C0C18B9609C66C1CB0F55A2F526000B4F5C99F827874889CDF
                                              Malicious:false
                                              Preview:Inno Setup Uninstall Log (b)....................................{D5806CCB-8635-4E7A-94FC-BF2723167477}..........................................................................................Clear...................................................................................................................................;...%................................................................................................................F..........a..................2.2.6.5.4.6......f.r.o.n.t.d.e.s.k......C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.C.l.e.a.r................(.;.... ......a......IFPS....N.......7................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE

                                              C:\Users\user\AppData\Local\Programs\Clear\unins000.exe (copy)

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):3149872
                                              Entropy (8bit):6.376122605923394
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C76E26901E5B975415817DC6691B10FC
                                              SHA1:D11283E30BFACABF622259C169E0DD7424AA882D
                                              SHA-256:9801DE2908996B63652A917F25CD28DBD3FF3E0A5DD1E872320C2E1B724CCE03
                                              SHA-512:6FC7F516F3D0BECFD2C8F564DAE4C9A6E09A5DC6ABABB1CD6AD0F1E6EFF3A50184BA55C3B91110FC0A621E1C781BF814177A3799A806031121884DCB8F95A9EB
                                              Malicious:false
                                              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................0.....qf0...@......@....................-.......-..9..................../.0(....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                              C:\Users\user\AppData\Local\Programs\Clear\unins000.msg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
                                              Category:dropped
                                              Size (bytes):24097
                                              Entropy (8bit):3.2749730459064845
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:313D0CC5D1A64D2565E35937991775A6
                                              SHA1:B8ACB11878C485865C9E4679248E53B83A8F3AD4
                                              SHA-256:5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
                                              SHA-512:7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
                                              Malicious:false
                                              Preview:Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

                                              C:\Users\user\AppData\Local\Temp\181e6924-5f84-4292-b982-a9f2d599c9bd.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:very short file (no magic)
                                              Category:dropped
                                              Size (bytes):1
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                              Malicious:false
                                              Preview:.

                                              C:\Users\user\AppData\Local\Temp\1ca2af85-2913-4d00-8e59-d8367191bd9f.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):44393
                                              Entropy (8bit):7.970286696092783
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2853D54685897A764505596C6FA3602C
                                              SHA1:38702C876CAA4AEF2C30104C8AA4C1621ECF0DC7
                                              SHA-256:BF40FF01F1DBE2D9ABFB805B70C328D94FAB313C7B81748CCE20751F4EC5EFF2
                                              SHA-512:8916D7F19E6E7CEA55FFED236EDAFBFC3ACD462193FCADD1A064337B25652AE2FCA5FAB31D9DDA1A79392DF426E4E1766B91A90C3A8F7076F5B979809061DC22
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a..9....O....)B.Tm.......Qo...\4.E.$.V.ym......R..A.....u.>[....p...VR.._R$...zo...e)UM.Rc.w4.6.......`v..-.....5%.J......8%.......7*..8n.9..R.O.......G.Zh...)r.Y...q. ..G..."........E.Fp..s........c..b .M."<m.PK.........!.U................icons/PK.........!.U................icons/128.png..@|..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.l.g.].&.O.7K....U..5.G..5.{.~]...^.v9a..06.$....!.....9.@`09.L...n.9...;}o.9..g_..q9....>{.9.7...Z..m...:.k.k8........;..m....wu....5.3K....p,9..:.M...sm.0-...8&.f......{...a.wXr.mz..V...|S~....}..@.gf....b...w,}&.G..=.}..\.......=....G.g./S........O.-.......7_C='.N...i.w..]./..kY........e.A..M.......4LG...Z).].....1=e#a......V7..wM}.....?S.~.g2......?...uM.4..,.?'.....x...d......R._.l....C...."P...Y....X...l+..q..'..t?.<.R^....5i.V..X....a....h..../..U...,..l{.J......S:..u..O.......m..8.P....H[...6........0J.s.`..<..J..A..V...6...J.........

                                              C:\Users\user\AppData\Local\Temp\31e0119b-6b1a-49c4-a093-7c698de4022f.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:very short file (no magic)
                                              Category:dropped
                                              Size (bytes):1
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                              Malicious:false
                                              Preview:.

                                              C:\Users\user\AppData\Local\Temp\53226739-40a4-40a1-93a3-a1e0cbd442c9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):529903
                                              Entropy (8bit):7.994583752679744
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:C914B2B6CD83E8B43DCC3C754B7F5E1B
                                              SHA1:7C1515523D90F2A9ED1A1DE6EDEED3B2C8AE964C
                                              SHA-256:A45E71A9551968C33E3222179B08ACCCCDFC55029A9C77CC5D5842D7ED34BAD0
                                              SHA-512:F5F4379CFE6FE341BC508215EAE9ECCFC4305B01CCA2099DD7B50F335AADCE23B7B13E0B38F6FBE4FD926BEFAEF1AD811DBD8B9EDB0010F9EFA56BE5559DF709
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a.....k..#....+.X...e .W..FU..",.e.|.....L.....5U...9.......@.8.i=I.."k....h\...`.PF............`O..h......R.........q...........+g...k...L..1.d..k`b.21..b"`..H..>.K.?.j.5dP.....p.s....F)........}.1..t..;.`."3*.PK........t.EU................icons/PK........t.EU................icons/128.png.'@..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.\}..H.,.Y_-...I..I.9!.0".....0"....E..F..................|...p....2...p...|....2\...0.n..{x...0|..._x.......}.._...u.....0<......\O..1.W~..>...#..p.../..$.%......m..yQ...p...p:.7.........8\.....~....\.p./O'.^..?..4....4\.oy.i...?O.M.../......_..x..q.r...g...v._|}._...v......'}9.'%.....|.g..'y...........%..._y?.a.....R..v......o.|...4....q....4~....y..4.....|.qG..}}...N..p.....4\..........".o.;..9.=.kow......Y.a...z.n..{q...v.....i_..KJ{Ty..........g....*.}..8...vm.....wW....>?.=.i.z.U..q.!...=....)..D.'..0..U.......e..m...}.f...E...W..P..g.+..R..J.u.

                                              C:\Users\user\AppData\Local\Temp\Top Sites

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.3528485475628876
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F2B4FB2D384AA4E4D6F4AEB0BBA217DC
                                              SHA1:2CD70CFB3CE72D9B079170C360C1F563B6BF150E
                                              SHA-256:1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
                                              SHA-512:48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\ac5e0f54-bc5c-45d5-8ee1-ae9087f9da4c.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):44814
                                              Entropy (8bit):7.9711714851847795
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:435825FEF59A7C9042E0DCA2EDB1794C
                                              SHA1:49EAABC13B032DA3FD5DE25AD72E27FEAD40CF3F
                                              SHA-256:5FD0E5E6742DBE501F93673A42332B5F6520F09E1C86B4506A9D0616D7444D89
                                              SHA-512:B2984B187FE9E1AC64C2A156FAF17B5D1BDE2AF01E0AA67132D7D3358C99CD38D1533A11D627DD056CC1388FED95E8229C46C60CEAF8613BA32CC37A549BDBFC
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a...)........iL..b...lA.<...(.d.}....KQ/..P..J....;r.9x.2.^....9.....g.G.<"m./.85.>..c.Mg..........`o"!.YK.[.o.Q......il.,.2....4C..| 0pO..~<.P3.^UUX.(.z..~........{........w.u.ti..v...3".........az.>+n.G.......PK..........EU................icons/PK..........EU................icons/128.png..@e..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.t...\.%.*... .n.X.^.Yc..V...v{u{..iu.IQ.EI..I......A..........s.....~.9..~xi{.s.}.>$c.X..^...s..'.{..u.z..pL....:.......l.p-......8..<t^:.....5=;V.8z.c].T.X...y8r......|G.......}S.o..c.k..i.s.a:.k.m.......&]W.c.|>.G....s..>.w.z.l9..c.....n.........._~.iX....../.0Y.....e<...h...LK..x7........0M}c.Z.#..nZ....,..E..yMg.b.A..4.`i...@.....=....8.m).:ro$(W.&..7...........9I1..xF....c%.k....\.e...8..+....>-.#...d.D.]....|]K...EuI....|6.K...L.a......A.92...(..)Ha;..,.<.(....xu>u.R..t.0.oJ+.....4H..L.-.....PJ.K...L..sie!...L....+...X2......o.... ...HH.)FD...

                                              C:\Users\user\AppData\Local\Temp\b5e1b74e-ad78-42f0-8d20-e22590dcea94.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):3522461
                                              Entropy (8bit):7.999346208829371
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:93B4315719396311C7D6013E0AF48417
                                              SHA1:BF86C6BD9495D575168D40730F4E36D93A3062EF
                                              SHA-256:3866F5E4D341D5C46DA307B3960FB26143BB13F08E74EA9565E7DB18EEC2161D
                                              SHA-512:D6BF4FA820B840571CB82611BF14736F1EB2F71A9D34426897E0277B32536B71B68A974DF864DDDF054DE19455A458AA4F418BCADD6C72FD944C59E2E32CCA1A
                                              Malicious:false
                                              Preview:Cr24....E.........0.."0...*.H.............0.........2.jy).`..\.a.............x.{c.pe....5.W>.r...t.bC.'.xow].$....."....PsK..w.I'...@....%A..6^2.^.a..#.K...,.lXc..},.-....s.S .87.6.2.#.\....W...P[....|.............ig.W.J...1.....V.R.%Rj.IAk.......5o....W.. .i!q.....7.=....*...')]!....D..._v..$*...........z....n..h..i.N....Y.....%...#t".Y*../.......p..op..a./e.Q....g......s..JD...)....*.S|..]..Ul.?.e....e...`......eb.`...Hi0./.l.M`8....XC>..p$...P<.;..F"..G]Uu.e.5."5c..-.........k...^..d.....e.3...d..2.9#..Z$.}......<.z$/....!..$......YE..!.`\.......'....n..X...>..PK.........zFU................icons/PK.........zFU................icons/128.png..@x..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.t...].&xn..%.q.TuuOX.WO.L.TM.Z.......26..`.Y...e.$r2.d.&G....P..9...'}......y.5b].}..{.9..........k..............=.......{..>.L..3.pM.]..c.w.a..X.k..9..>.....a.g.6....~..O..{..._[.suM.k8.z.~...t.Z...o.G..M.t..Q..M.k~C..o..a..a......l.L.0..q.

                                              C:\Users\user\AppData\Local\Temp\c693a023-ba0b-4e3e-9285-9ce8b5f3f3d5.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:very short file (no magic)
                                              Category:dropped
                                              Size (bytes):1
                                              Entropy (8bit):0.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                              Malicious:false
                                              Preview:.

                                              C:\Users\user\AppData\Local\Temp\clearbrowser_topsites

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                              Category:dropped
                                              Size (bytes):20480
                                              Entropy (8bit):0.41215124037614637
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8CC4825C227D59B66476099DC25BC29
                                              SHA1:F6EC4D56D72553E4EAF4C000AC9D86107CFFB4F2
                                              SHA-256:74FC3F0A9BBC7BD4AAE7791513FEAA4FE7C51FFC6DAE5F34FDBA093FF8255426
                                              SHA-512:C4F0A591589052984E5BC8EE0402C8FE71A7CB9409626505262423FCE0E837F622B5F404FC611655D224FCE7FA4D0B279F563F94BBEC99AA225D98B086B996C3
                                              Malicious:false
                                              Preview:SQLite format 3......@ ..........................................................................[5.........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):523776
                                              Entropy (8bit):6.6168873650429205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8693D7EA0B258EDF72C6EF7CFF1E46FB
                                              SHA1:3051A64087552B9FEF8B575A291163AEACA51A3D
                                              SHA-256:108AB5F1E36F2068E368FE97CD763C639E403CAC8F511C6681EAF19FC585D814
                                              SHA-512:83AD7CFF4592C06AE88A6203078BE6705635F7F3A27BB3F83229A7C9569737ADB87CD07727EA606EE8230E3E9A8ACFCB902A9CE1681529C278096514FBDCD2D5
                                              Malicious:true
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?G..Q...Q...Q...]..Q...Z..Q.C._..Q...[..Q...U..Q.N.....Q...P.P.Q.C....Q...Z.B.Q...[..Q......Q......Q...W...Q.Rich..Q.................PE..L.....n\............................&S............@.......................................@.....................................x....@.......................P..dF...................................................................................text...%........................... ..`.rdata..............................@..@.data....i..........................@....sxdata......0......................@....rsrc........@......................@..@.reloc...O...P...P..................@..B................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\HtmlInstaller.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):193536
                                              Entropy (8bit):6.820697840348735
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:791D68DCE7325A509665B70B7AE68C46
                                              SHA1:B783D87279177ED40FDF3CBFC90F907CC1824F3A
                                              SHA-256:E86F4AED27C1CF6A700CD3D4C3C678FE81E0BF96F65AABDDC2E8C3A1A3A9544F
                                              SHA-512:7C9BD043E068F696FE42F5276355FA442BBBFDF22637EBA5EDCBEAAF3E64CFBBD5CFA8908EACB26C3D14D9B135F5D4E2F1901D3C9F4A6E12830B42A8779F44F3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.e...........!..................... ... ....... ....................................@.........................8 ..(.......O....@.......................`..(.................................................... ............... ..H............text...4.... ...................... ..`.sdata....... ......................@....rsrc........@......................@..@.reloc..(....`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\120.0.6099.199.manifest

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):228
                                              Entropy (8bit):4.890604933532555
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D82A50C6750AF1EA0480E648E9B7EC97
                                              SHA1:64B84CDBABA77625C95C29249F872BF72BCE8081
                                              SHA-256:343EEDBE46C18B0ECCD53B5760368A599BE3BAC084FCE25CD693947B3BD08901
                                              SHA-512:6520CCE1B30D1C8FF151AF20BB3AA3CDB104D0F3CA16D9736FE6642051694D88258CC3F9607710AC386B93EFF4FDA8533E0C41A335932613C98D78B14E9667A7
                                              Malicious:false
                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='120.0.6099.199'.. version='120.0.6099.199'.. type='win32'/>.. <file name='chrome_elf.dll'/>..</assembly>..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\First Run

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):8
                                              Entropy (8bit):3.0
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5206EB9697BF5F2978F399F4869CBF18
                                              SHA1:4D6AE0E8CCEF787681E0F6C9E912EA41CDFFB758
                                              SHA-256:839ADBAACA1C43DD4575C502ADA96EBB4651F1A69B6FC5E42679BEB47584181E
                                              SHA-512:634535B9A6AF54D3B78A85F8F473E09BEA0D2C47C8E97B84B5F879DC1E7E9F387C81A80D1221A04C26AD7AFBF14D8DBCFE22430BF3EFBCEAE18EDA45E964DBB3
                                              Malicious:false
                                              Preview:krome ..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\MEIPreload\manifest.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):238
                                              Entropy (8bit):4.824253848576346
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:442699C95B20A60470421C6A4D29960F
                                              SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                              SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                              SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                              Malicious:false
                                              Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\MEIPreload\preloaded_data.pb

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8254
                                              Entropy (8bit):6.795641289553097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                              SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                              SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                              SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                              Malicious:false
                                              Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):215236096
                                              Entropy (8bit):6.651476064795753
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:50668F17584CCF580240E67CB56EEF3A
                                              SHA1:EBD9B0E32E70296EB9B9AEA33480AE3D0CECF2B7
                                              SHA-256:441590E714D6715DD9DCE7C066029E8F0610B1B62A31D3EEDE5517D2C3D67468
                                              SHA-512:9F080CDFE1708289A9E5305A7A831B80E3C29E26888FDFC530D3552848110123C8815A11EE4B278F5BC0E5443B24B6B9407687EE07E32E798E06DFA448C820B2
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....h...................................................@0...........`A........................................o"e.....~#e.h....`.......@..."F..........P......@.W.8...................P.W.(...P...@...........p8e.....p.d.`....................text....g.......h.................. ..`.rdata...y.......y..n..............@..@.data...(.f..0j.......j.............@....pdata..."F..@...$F...t.............@..@.00cfg..0....p......................@..@.gxfg....C.......D..................@..@.retplne.............:...................rodata..............<.............. ..`.tls.................N..............@...CPADinfo8............T..............@...LZMADEC...... .......V.............. ..`_RDATA.......@.......h..............@..@malloc_hV....P.......j.............. ..`.rsrc........`.......p..............@..@.reloc.......P.......V..............@..B................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_100_percent.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):686222
                                              Entropy (8bit):7.962928283524176
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48321D24D66927A1D1ECC339E1845259
                                              SHA1:3668BEA05AC282130D7B1BF5CCF4A2CE303581D0
                                              SHA-256:D02726B9814E34DD40C470DB848CDD8B2BE69A2E25766CF9EB2F82AE25B08004
                                              SHA-512:9C9D45F7C2F309519582A9F0D6A116021C37D28A2EBDB31F1F6DC5FECF836D2E714D52D015AA9FEAAE692798AB42B6C1C60D715C9DB442733E10D0A675D9E8CE
                                              Malicious:false
                                              Preview:..........L............... ...........@..........;M....;.....;$....;.....;.....;b....;.....;!....;x....;....;5....;.....;....;@....;.....;....;L....;.....;.....;.....;.....;&....;l....;.....;N....;.....;.....;.....;.....;.....;.....;.....;.....;.....;H....;.....;.....;g....;.....;.....;.....;s....;@....;.....;f%...;.%...;`&...;.'...;.'...;A(...;.1...;.:...;.N...;.b...;.c...;.e...;yg...;.j...;.q...;.x...;.....;H....;.....;.....;/....;~....;*....;.....;.....;,....;.....;.....;.....;.....;:....;8....;.....;.....;.....;D....;.....;.....;."...;a+...;.3...;79...;.A...;.B...;.`...;3z...;.....;d....;=....;.....;Y....;.....;.%...;W8...;Ia...;.u...;t....;!....;O....;*....;.....;.....<.....<E....<.....<."...<.,...<.4...<y<...<.D...<.I...<vU...<._...<.c...<_h...<}m...<.~...<.....<.....<o....<r....<&....<R....<.....<S....<.....<.(...<v7...<;E...<'O...<!V.. <(]..!<3r.."<...#<:...)<....*<"...+<#...,<...;<7...<<*...=<...><...?<....@<....A<....B<&...C<....D<....E<....F<....G<....J<....K<Y...L<5$

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_200_percent.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1048078
                                              Entropy (8bit):7.950396437745758
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:102C7F476668759F051DCC36C61A934E
                                              SHA1:25FA1A726D596E9A25CE500A49D1E9CDC7134791
                                              SHA-256:E0EAAF4E8F1AD3E024387FDAF46FE67DA28B751FE18F473E5B6D968E067D5B07
                                              SHA-512:BD68480E4F46574309406DDC5F6862B92070026CC5E468C38906F8AD6A265016B3C0E3B3C9981473807131469B3E5621E3A2A7BEAA64D71974FB2A99EE5C1D6F
                                              Malicious:false
                                              Preview:..........L.........+...........|.....#..........;.....;x....;....;d....;....;P....;.....;'....;.....;.....;_....;.....;-....;.....;.....;W....;.....;.....;.....;3....;Z....;.....;.....;-....;.....;}....;.4...;.R...;3g...;A|...;.~...;.~...;.....;|....;.....;.....;.....; ....;....;#....;.....;t....;M....;....;.....;C....;.....;.....;....;R....;.....;.....;k....;.4...;.6...;e8...;.:...;7B...;.R...;uc...;.t...;.....;k....;.....;.....;3....;.....;!....;W....;@....;.....;./...;.B...;BR...;.e...;zy...;&....;.....;?....;.....;E....;.....;.$...;.8...;.P...;._...;Mx...;I{...;=....;.....;=....;.....;.....;.....;.0...;fB...;}^...;?q...;=....;.....;.....;9....;s....;Z....;.....;.....<=-...<.;...<.Q...<O\...<Pf...<.m...<.v...<M~...<.....<6....<.....<L....<....</....<.....<.....<.+...<.X...<.y...<.....<.....<.....<.....<.&...<|D...<.b...<.}...<`....<.... <...!<n..."<5B..#<.B..)<+D..*<.f..+<...,<9...;<....<<....=</...><...?<)...@<....A<....B<g...C<8...D<u...E<.B..F<.F..G<.L..J<.T..K<.a..L<.n

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_elf.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1253888
                                              Entropy (8bit):6.461722096170348
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:417E6D505060EA7B80F3EEA2FB37FC73
                                              SHA1:8FF255320737334ABF8EE4BBCFFA005E4CF5C594
                                              SHA-256:52539B62716646F3E0331FCD26B70F66AFC65D1CB7A60A0CA42947660DF626FA
                                              SHA-512:E5455F8DFF85661965B52F197644911EC5946925C68B982DC24A9CE15F0FCC405E316F66255283906DC5DB22B2B4761FD0ECAABC14BA8203AB8C7E0EFD074349
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .....|...................................................`............`A................................................=...P....0..p.......\............@..(...L...8................... ...(.......@...........X...............................text....z.......|.................. ..`.rdata..............................@..@.data.......P.......8..............@....pdata..\............8..............@..@.00cfg..0...........................@..@.crthunk............................@..@.gxfg....-..........................@..@.retplne.................................tls....z...........................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...p....0......................@..@.reloc..(....@......................@..B................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_proxy.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1098816
                                              Entropy (8bit):6.491648618887458
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2AA4D6714A782F061E712E814C5F4AC0
                                              SHA1:A069BD2FC63205EAD2299A0E5B8B5C64D7B0DEBF
                                              SHA-256:54EA18533A93F893E2C3383420CA717D1DBD3911EA7A692EA81D36D070931297
                                              SHA-512:F11A5C076ADF19AD2EC010D94D639BE11E40B2342A66DFA0B0C1B14DBFF20D010DA1FF0DBC325347EBF5BF42F99BB3FBD0DF163413995559AB8CB2159257F8EB
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."......v... ......p|.........@.....................................2....`.........................................@O..U....O...................u......@(..........\D......................@C..(.......@...........8U...............................text....u.......v.................. ..`.rdata...`.......b...z..............@..@.data...0...........................@....pdata...u.......v..................@..@.00cfg..0.... .......J..............@..@.gxfg....)...0...*...L..............@..@.retplne.....`.......v...................tls.........p.......x..............@..._RDATA...............z..............@..@.rsrc................|..............@..@.reloc..............................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\chrome_pwa_launcher.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392640
                                              Entropy (8bit):6.30352361371339
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6F935C43F801B3132135A84519A72A65
                                              SHA1:0CF33267EC120BFAFD98CCDC7C962EE4CAFC14FB
                                              SHA-256:D157D1EFAD3C6B8D264F7568B7BED1649A742BEFE412EB7D00DC4D83FAC3CE8E
                                              SHA-512:F50A347C62867CA28A85B6B975B4519494D12A20A6659F06C0F3E6A132878A104042C2D80C8804FC5FFD55878F1E62573BA69B6F55F05B1AC1CE16C3C363ADDE
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........f................@..........................................`.............................................\............0...&... ..hy...........`..p...............................(.......@........... ...`............................text...v........................... ..`.rdata..<...........................@..@.data........p.......J..............@....pdata..hy... ...z...B..............@..@.00cfg..0...........................@..@.gxfg...@+.......,..................@..@.retplne.................................tls....z...........................@...LZMADEC............................. ..`_RDATA....... ......................@..@.rsrc....&...0...(..................@..@.reloc..p....`.......*..............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\clearbrowser.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):2166320
                                              Entropy (8bit):6.433313872060691
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:973083D0D50F0C6369162207CA811C69
                                              SHA1:76D54C4BAC7FDABEA111571DB3F6B6E9AC170986
                                              SHA-256:93F34E1BF6B0E90C52F7C283A5DF793C6DA7F4C87BD0F7CCB664F751822F5426
                                              SHA-512:C608B888920E0F210D309FC4F5F57F96D0327E366CF926E8A921FDB656D0882009602EA378ABE2D1480142362FD23002034CD7F10449B2B301DDC543FF5AB4C6
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."...... .....................@............................. ".......!...`.................................................\...d........ ............ .0(....!. ......8.......................(....A..@...............8...(...`....................text............ .................. ..`.rdata......0.......$..............@..@.data...8...........................@....pdata..............................@..@.00cfg..0....@.......f..............@..@.gxfg...0/...P...0...h..............@..@.retplne.................................tls....!...........................@...CPADinfo8...........................@..._RDATA..............................@..@.rsrc.... ......."..................@..@.reloc.. ....!..".... .............@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\elevation_service.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1649752
                                              Entropy (8bit):6.513026085681496
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:971F982664399F305E11A44A7F2E7CEA
                                              SHA1:0480BF32029151C8759F9183E61507F205FA7D9B
                                              SHA-256:88BB3A6653278E6613782CE6444A7D0A20B0EDE964D0BCA554BB186654AE1873
                                              SHA-512:67FBD59F37789D407520E78DF9FB911E98314678EC3AAF7EA46E5B6312468A61E54A8508F7DBDF8401C4083847C0CE0D15DABD0E6DE2DA35936B79C3C05A8BE3
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..........L.................@.............................@......=.....`.........................................`W..Z....W..........8...............X(... .......F.......................D..(...P...@............`...............................text............................... ..`.rdata...D.......F..................@..@.data....... ......................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...8...........................@..@.reloc....... ......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\icudtl.dat

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):10717392
                                              Entropy (8bit):6.282534560973548
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                              SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                              SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                              SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                              Malicious:false
                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libEGL.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):455680
                                              Entropy (8bit):6.344963333214366
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3137029764C050067D41B71BC210F932
                                              SHA1:73B6C4847F5DE202D71E45F231C3B42B9F9AB470
                                              SHA-256:DAE17055C7F0065FC9D421CAC0C7DE0E6BEA0FC7CA3AAAF3DB5C44AC9E754D8E
                                              SHA-512:BAE88C49F31E64F7A45BA689D820E8ECF83697C9BDE69E430D370C3B12BA17A23ABC67036B8CD20694CCB46A86DE1E691E0CCD5E58A6DA031F98BBAE969CA93D
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." .................&....................................................`A........................................`...h.......(.......x.......4A..............P.......8.......................(.......@............................................text............................... ..`.rdata..dw.......x..................@..@.data....K...p... ...N..............@....pdata..4A.......B...n..............@..@.00cfg..8...........................@..@.gxfg... &... ...(..................@..@.retplne.....P...........................tls....!....`......................@..._RDATA.......p......................@..@.rsrc...x...........................@..@.reloc..P...........................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\libGLESv2.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):7727616
                                              Entropy (8bit):6.443214904498888
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9C358F1191CF2D4E77A90FB2AB57D9BE
                                              SHA1:D94FC8A441AB565407CAEAAF2F05C381A550FAF6
                                              SHA-256:BEBE06A370169EC96EE868C9DF34CBDA2C97632F4F8935097B8D777089CE3425
                                              SHA-512:8B6FD15DCE4A6117D9C4D11A93995C8CF0DB34A320E7277CB37C9252897F55459438C0FCF7D5767A0D62CA8C7331276846BA5763FDBC7BEA63946F0447DC9B7C
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........." ......Y..,.......aV.......................................v...........`A.........................................[m.....S8n.d.....v......0s..T............v.......l.8.....................l.(.....Y.@...........H=n......Zm.@....................text...%.Y.......Y................. ..`.rdata...:....Y..<....Y.............@..@.data.........o.......n.............@....pdata...T...0s..V....r.............@..@.00cfg..8.....u.......t.............@..@.gxfg....,....u.......t.............@..@.retplne......u.......u..................tls....B.....u.......u.............@..._RDATA........u.......u.............@..@.rsrc.........v.......u.............@..@.reloc........v.......u.............@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\af.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):425311
                                              Entropy (8bit):5.395319539126201
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:44396D9D8F0F0AE4CE756C49D534FD3D
                                              SHA1:8FAB9BFFFCF3B5B7C68C746F32F6A44CC4E1CCFF
                                              SHA-256:AF7200191D8EC87E6A9CE38F40E9B125E6A7896B1531E86773E24F79D82FB47A
                                              SHA-512:67EC69EC2595B6E35D428E0D4E395D1245A2FE9A16556171854F9C6FFB1E8102F8BD90F10996E2F162D7DF00CA94E7E194C56631994F3BDB6B1D92E4F452B23C
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j.....w.......................-.......................a.......................s.................1.................,.....E.............................v.......................j.......................y................. ....................... .........................................(.....>...........&.....o.......................8.....I.............................V.............................q.......................e.......................A.....i.....r.................1.....:.........................................4.....K.......................&.............................d.......................\.................$.............................R.......................R.......................x...........D.....X...........1.....p.................V.......................-.....Q....._.................8.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\am.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673037
                                              Entropy (8bit):5.040592901795516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D5E58828AFDA6783690ADAE466AC3346
                                              SHA1:B716C2D7012C3CBAFD39E62EEF0B4A7BE3691A87
                                              SHA-256:55DA7EC2D2E3018270D67B759EDEDFE11F64BF41CC7C6443E3B07540C78E5689
                                              SHA-512:B5A5522FBC5FB1F31DF7AD7D939A57CD004F5ECC7A65E5E9F567C6543D7591763BC6D541C56FA3663BC19C6314382645AEBB274FBCC7EF4E539A946C3457A126
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...........................................................J.....j.....+...........Z...........].............................9.................J.................%.................h.....~...............................................G...........`.................~...........l...........7...........(.....G....."...........i.................m.................0.......................\.............................l.......................%.................(.............................5.................".............................^.............................+.....R...........J.................?.............................K.................z.................8...........\.................|...........^...........Q............................./.......................H.................6.............................&.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ar.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):739356
                                              Entropy (8bit):5.019903284276821
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25DE0C26D95E19F5DA6B5D71A10EB0FE
                                              SHA1:1C3854692C3D03FEDB106AD330DB9A6EEFC454A7
                                              SHA-256:20F07E78D04C499DBBDD49C6495832FC98B401450EA349F236CB2E2460DF2996
                                              SHA-512:A66A2C29E65394E0DFCDDC393FDED51F18901D2E42879CCA8F3A0020A1F0B4B5F555EDA4CE3AE1318A20CE4190CC3064FF06A2BE6E3CB1C2BFEFB7A6E35ECA3A
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w.....y.....z.....|.....}....................................................... .....%.....>.....[.............................K.....o.......................!...........}.......................r.............................a.....x...........k.................T...........8.....}.....8...........J.....p.....O.......................c...........W...........&...........a.....|...........p...........O...........].................N...................................W.....w.....'...........Q.....o...........n.................d...........N.....r...........w.................S.................4...........k.................m.................E...........@.....u.......................4...........W.................\...................................d...........................................................c...........A.....x.............................C.............................G.................[.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\bg.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765476
                                              Entropy (8bit):4.7975051327532885
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D67EFF3B26F9936A13D7D5D0570F80B
                                              SHA1:FF49B010D1723EC7AB625C8C586906F27AC09C82
                                              SHA-256:854BE8369C455D8321A8784FC4957CF402D75178F9CE74F7C131CD68E85CF6F2
                                              SHA-512:71C6F7578457DAB046142E39B7EDB19A362B712E81DEF3A0E4BF94E44015930A3CA24EA83A76E03A4EC65DB73EEA389E1AB8C2D78F93CB239F701845AFCE65E0
                                              Malicious:false
                                              Preview:........? x.e.l...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....|.........................................y.................1...............................................u...........<...........g.................l...........D.....j.....V...........v.............................T.....>.............................2.......................s.........../.....B.............................+.....j...........8.................C...........h.......................%.................N...........".....A...........T.................M................./...........b.............................c...........?.................=...........E.......................].........................................2.................'.........................................!.....V.....F.....!...................................g.....2...........%.....].........................................N.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\bn.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):970497
                                              Entropy (8bit):4.416502608555437
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11AF78A74835CB6CD030453E00D48320
                                              SHA1:5801BCE64FAD3B107BFFBB010D911B585214D281
                                              SHA-256:79588276DA84298C19C112AE665D01362524A775436FF85AFD9F3BA65CBCCA85
                                              SHA-512:38BAEAC624A95659AA06CC2A2C60521D874CDD6CDB9B1290C458A771B1F25D085711387303E13B5078588C46653FB3E9DDF73512FDD7DA88359AFD50A0A85F68
                                              Malicious:false
                                              Preview:........+ ..e.D...h.P...i.a...j.m...k.|...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....?.....G.....N.....U.....\.....].....^.....c.............................?.....I...........A.....6...........................................................D...........@...........m...........Z..........._.............................s.....Y.....0.............................Y...........U...........g.............................K.....o.....g...........a.....*.................;...........s.................r...........7.....Z.....:...........S...........O...........K.....w...../...........#.....I...................................R.....................................................`...........=.................8.................3....._.....G..... .........../...........z...................................!.....$...........z.................9.....,....._.................= ..... .....!....A".....".....".....#....{$.....$...."%....(&.....&

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ca.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):483305
                                              Entropy (8bit):5.374751120312463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6859AD6CCE882ABB0A44C0346F472D60
                                              SHA1:3500DC166D1E0BB0CA7B8A63DB3C5AEFB9C952B8
                                              SHA-256:2EE150C1BBB0C8271470312B4A0B217E2BBB33AA62D19C76EA13CBEF7EF06FB4
                                              SHA-512:E482DCC2D8A3C28EDD6AD688A16E107B107155FB83A388227DCE56CED735288E1384BF49AFEBB31850B67B516CEF8B328EB0A305ABA07F2494FE4F0031C58981
                                              Malicious:false
                                              Preview:........4 ..e.V...h.b...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....`.....a.....c.....}.......................y...........u.................i.................^...........B.....a...........$.....\.....y...........(.....[.....n.................R.....c...........M.................B...................................2.....F.................7.....K...........).....n...........%................./.......................,.....|.......................Z.......................Z.......................i.......................V......................./.....z.......................j.................2.......................g.......................b.................*.....y.................H...............................................k.......................u.................&...........K.................X...................................0.....P.......................$.................<.....X.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\cs.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):484288
                                              Entropy (8bit):5.8243114746271765
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:485EA7CEEE6AE86812D834B6AF09B9CE
                                              SHA1:72F04594DF8C55EF4D3A9480FDC91320A7795C05
                                              SHA-256:66BFD87719482196D0A92D46DE25EE6E76B33CEFC8722748377444D7C0C637E6
                                              SHA-512:1734378C3680A5A544A24671D439C7D6F11F54A2382A8F77D7A937FAACE1018D8900128815438BE1973C26209A8CBD02908712535275A7CD7ECB2675DB2EA769
                                              Malicious:false
                                              Preview:......... ..e.*...h.6...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................%.....,.....3.....4.....5.....7.....G.....Y.....k.............................-.................&.....5...........8.........................................C.......................?.......................B...................................Y.....{...........b.........................................?...................................M.....g.................6.....M.......................0.............................n.................".......................,.....}.......................r.................#.................,.....@...........5.....y.................(.....C.....W.......................8.................+.....A...........!.....b.................?.....Z.....n...........Q.......................p.................<...................................f.................j......................._.......................r.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\da.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):447763
                                              Entropy (8bit):5.433512556683707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4B255615C23E814B83D07D2589B6873
                                              SHA1:E5F1BDE47A801CA0AC3301A91FF1777AE4CD521C
                                              SHA-256:C37B702D42F00B85986B914763323B13E125135A1DD6D70EB061AB818C6963A7
                                              SHA-512:BC35E233DA11563D508E5F4819AA1CD10BCB9F64897F569E4BF2256237A271795FEDC9CEA5B528D26466AE95E8E0127DC69EC90280D776E28C2E55DE31E277AC
                                              Malicious:false
                                              Preview:........= z.e.h...h.t...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|.....~.............................:.......................o.................6...........B.......................{.......................n.......................V.......................W.........................................U.......................|...........!.....5...........>.................;.................9.......................(.....v.......................O.......................:.......................@.......................9.............................x.......................a.........................................R.......................6.............................g.......................|.................L.......................L.......................d.......................`.................&...........7.....m.................h.......................B.....^.....k...........-.....d.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\de.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481827
                                              Entropy (8bit):5.468895402229888
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BE0AA0C39FADFD77D58CE689CBB42ECC
                                              SHA1:66F8B730DB8405EFC1766AB3742D6F3096221E3B
                                              SHA-256:22D1AFA7755CA9AC4AEA0015C51639F3DF160E88C072BA534E9481E1ECF641EF
                                              SHA-512:0F63D76118367E16BEE3A02E42577C903661DADCD5A0FCBD90C05CEE5119026492AF6559250BAEC9EC1370B81D7611263BE90C1350E2235D3360D315BA1645C9
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.......................o.............................).....b.................c.......................}.................H...................................b.....l.............................e.........................................)...........(.....`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\el.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):834421
                                              Entropy (8bit):4.876465138992703
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EB779878D14C459E60B04FE3154AAE6C
                                              SHA1:781A2502679E3464B2DE04319A17EB123B38F589
                                              SHA-256:0784AE7F982172A3F0C9FD654A3781D263F98A01AC702291D404F70DD7AF371E
                                              SHA-512:527CDDA3CF3EF63EF6331AAD0A68572F1276A9CB6A93E8931A96FF90974E818549E96DD6A8963222C5DD67BE7D2910B46619E609A8DFD9EC8BB955AA88051F7F
                                              Malicious:false
                                              Preview:........8 ..e.^...h.j...i.r...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.......................(.....O.....-.............................p.............................`...................................%.....{...........A........... .....@.......................g.....o.....i...........8.................I.....d.....K...........y.................P.................:.....2...............................................V.................d...........R...........i.....C.......................o...........................................................$.............................%.....-...................................,...........U.................g...........U...........o...../.......................R.......................B.......................m...........&.....P.....k.....!.....Z.....[.....B.........................................u ....?!.....!.....!.....".....#....P$

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\en-GB.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):390679
                                              Entropy (8bit):5.489673740325356
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E043647BD2DAE08B42867F76C9F8A7C0
                                              SHA1:00F62CAA07C28A99D3DDF64F1E0D346C1DD0B9EB
                                              SHA-256:A60148B1795518660991015F7083E0CAAC406E9188EEEF7A9675B57CD1424DF6
                                              SHA-512:88AF4FD99880C0AFFE4E3D87C6E34100E0B235E92B2B5C302A6D470521E38C1A783F6FF20D2B4F2DD0FBB708EE4AC0446EAC659BED0D24B77654928E6C330237
                                              Malicious:false
                                              Preview:........s D.e.....h.....i.....j.....k.....l.....n.....o.!...p.....q.4...r.@...s.Q...t.Z...v.o...w.|...y.....z.....|.....}...........................................................................................'.................A.....T.................).....9.................5.....K.......................4.............................F.............................T.....y.................G.....|.................5.....f.....t.................6.....F.............................|.................0.....o.............................I.....h.....r.............................x.......................Y.......................$.....i.......................).....Q.....\.............................~.................).....w.......................9.....u.......................9.....Z.....i.................B.....h.............................l.......................[.......................V.......................}.................(.............................L.............................h.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\en-US.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):393882
                                              Entropy (8bit):5.483434307919725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B7B76968BD06518708C4EE49057C3C21
                                              SHA1:C709EA98C29253F44C4535D69CEED0C7A5A10D89
                                              SHA-256:AE3EA3E3C6AEBC3B2A117E3260DB57920A300F53234347C5C994A6667697A7B9
                                              SHA-512:538063408F1F8FE5294763AEB28EDBE3F7AEB09D14BAB32C67CD117B56DF9FCF13F8A31D4C74E8757B5CDA550AF4BA99C9BF6E26E75A6B1FDFAE036628BA1E29
                                              Malicious:false
                                              Preview:......... ..e.6...h.B...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....b.....r.................W.......................U.......................U.......................K.....z................. .....I.....W.............................h.......................G.......................9.............................\.......................+.....W.....b...........+.....m.............................!....._.............................B.....c.....o.................I.....\................. .....,.....u.......................6.....z.......................;.....d.....o...........*.....h.....}.................-.....C.............................M.............................d.......................;.....V.....e.......................>.......................3.................M.....[.................N.....k.................9.....H.............................Z.............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\es-419.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471567
                                              Entropy (8bit):5.354079420195156
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2BAF163FA95FA30FC29E2E5871D24CBD
                                              SHA1:9381B41FFE7EAEB7B269FEA54160BC6AB7871548
                                              SHA-256:EAA363739EC52548F4A32F9C6ECE214FE5534AF8A0597D271F6AF26AB2263B44
                                              SHA-512:B053B7503C1E650B2094DB6003B93ECC9A34E0847312B418AE813036644E4DBCBADEA914F546EB4753C3B30642A9664B737D4F9C3F4DE6602112A1F67511725F
                                              Malicious:false
                                              Preview:........> y.e.j...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................X...........L.....g...........?.................0.................+.................Z.....u.................B.....U.................:.....K...........E.................D.................".................D.....W...........,.....j.................m.................h...........@.....g.................-.....H.................!.....0.................(.....>.................`.....s...........7.....u.................-.....^.....i.................B.....L.................Z.....j...........]................./.......................9................. .....w.................H.................@......................./.................%.....>.................W.....q.........................................P.....~...........d.......................U.....x.................|.............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\es.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):470778
                                              Entropy (8bit):5.34217037343731
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E004770D6760C02517131A19939E118
                                              SHA1:A326BB7848CAA86E7E07A5D4986C31348EC8CC50
                                              SHA-256:A687A109FF23A4A7CDD422BE9419987D942725E289856A65129C0499199E4DFE
                                              SHA-512:4DCFBAF81006095B2C4E0EC98F94294A01EB45A1D42A933067AF9110FDD6F14EFECB1F8900FE541F772D66C60484C9AE6B644C7852364486B0072D7F132423EA
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.'...|.-...}.?.....G.....L.....T.....\.....d.....k.....r.....y.....z.....{.....}.............................c...........[.....v...........X.................D...........4.....N...........1.....m.................C.....r.................D.....l.....}...........w.................k...........$.....B.................].....n...........>.....z...................................{...........?.....d.................L.....b.................6.....E.................>.....T........... .....S.....f.................O.....[.................9.....D.......................&.......................#.................X.....r...........(.....T.....q...........".....I.....h...........O.....t.................|.................a.......................U.......................k.................&...........:.................=.................1.................U.....i.................4.....G.................X.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\et.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):430694
                                              Entropy (8bit):5.456758351557824
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22F9E4FE76C5CF3239DE215AD36D3FCC
                                              SHA1:E71E47F00187A851B1DB6ECC5A2AE2C3F942E039
                                              SHA-256:F8E9C973248868531DF9EB55A914C30E1FB3CA9BC4B6CB7DEAB65BB8919FF158
                                              SHA-512:E8AD9C50CE97F5F0563DDA08B870FAABE660FF4A495EB05173E9A6E6E297668F9BBCB08C73D2731604A221111BFCA4AC0982B3ACD68EAF452B9F19EE68180FAE
                                              Malicious:false
                                              Preview:........A v.e.p...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................Q...........H.....c...........2.....b.....u...........W.......................s.......................k.......................Z.......................Y.......................~.................5.......................9.......................I.......................v...........9.....P.................7.....R.......................*.....}.......................u...........!.....,.................-.....;.................%.....-................. ...../.................".....*.................M.....e.................2.....H.................*.....M.................2.....?.................;.....g.................$.....5.................!.....9.................=.....X...........S.................A.................,.................>.....K.............................}.............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\fa.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):678188
                                              Entropy (8bit):5.164547717738943
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0B950CEF45650A2BD1591C494ADE1D6F
                                              SHA1:DC2AAB36C670E1962BA10517769EDE124BAE27F6
                                              SHA-256:21CF1181DC3002C1BCB1B58127FB2F778F01E6277C73611868AC0B55B95A2633
                                              SHA-512:5DF42AE149E302E83E297D872E6F3B71E064E582ADD7A231D3889936485EE0339AF259F2EB51A1DAC464082832039B55B36CEBC55093A5CB42F68163F850A02C
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....n.....o.$...p.1...q.7...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}.........................................................................#.....M.....t.....Y.....*.................~...../.......................?.......................h.......................-.....s.............................&..........._.......................1.....}...........;...........'.....C...................................e...................................0...........9.....m...................................o...........E.....\...................................".....i...................................d...........4.....V...........|.................|.....+...............................................J................._...........L.....l..... .................W...........M.....r...........G...........C.....e...........................................................0.................s...........i...............................................l.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\fi.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):435709
                                              Entropy (8bit):5.427114715109804
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E226109EBF9A43AF5D95F6066B24915
                                              SHA1:076AB0214579858F697D7193847AFC3A046390D8
                                              SHA-256:39D5B787C10047C718228DCFCEDA3576FE9201DB0BB99CC60BA5D6BB5AE48560
                                              SHA-512:132726A998DBF27C410D318CBA7DA9D5F140D612FAF68F1FF5F5A40155C829E387C1CDCDCEEC77441CEE7B79F8634FB090ACFE4F17550806011B2574249AD712
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.!...k.0...l.;...n.C...o.H...p.U...q.[...r.g...s.x...t.....v.....w.....y.....z.....|.....}.........................................................................#.....4.....G.....`...........e.................6.......................H.......................o.................".....y.......................W.......................-.....|.................4.......................Y.......................U.......................X.......................x...........0.....F.............................{.......................A.............................[.......................?.....n.....{.................C.....N.................-.....=.........................................8.....P.............................k.......................a......................._.................!.....i.......................3.......................4.....~.................W...........$.....9.................6.....R.................<.....N.............................W.............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\fil.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):489863
                                              Entropy (8bit):5.201818119132309
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3C9C48A7DD48CC2B23055475FE9E228
                                              SHA1:91144E5B4C21C9520B1D61F8E41CE91747D518DA
                                              SHA-256:6EC573C3A957A655B024E23CC8610C4DCE840181F23546FEBE7E8CBA89C4583A
                                              SHA-512:6956C9FA70B4210A3635E6D2FDBB53E2BEBC3A56B40CB783C2D7F820E180E5F4487A766EA8CF0C88EBAC023D3368DB873479D1A4B845DFFADC7653B68CE8FBAB
                                              Malicious:false
                                              Preview:......... ..e.(...h.4...i.J...j.V...k.e...l.p...n.x...o.}...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.....S.....h.....~...........7...........&.....D...........;.................=...........*.....Q...........F.......................j.......................}.................T.................4...........J.................9...................................4.....N...........I.................B.................P.................:.....W.................-.....:.......................'.................?.....U...........!.....W.....f...........).....[.....i...........*.....[.....i...........,.....^.....l...........m.................>.......................8.......................(.......................Q.................A.................2.....L...........*.....].....x...........l.................u...........x........... ................. .................6.....N.......................D...........:.....v.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\fr.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507710
                                              Entropy (8bit):5.366267790955764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E7EECD5B19E0FBE4A6D6FAFA81209C4C
                                              SHA1:46BC876FB95610EABD7F8A4734B45FBA629B76E2
                                              SHA-256:9EEEE70495C1D52F4260E86B23ACF8AEA21E68008A45A41BA0556AD48EADE2BE
                                              SHA-512:09E2AC627360DE3A8D5172E8E8BE084AEE07127CBA04D042213A9E9EEEA35011952DF49EAAB0F28DAE587ECA61D8CAC5EB7B197BDF96044265F52AB507D9D471
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....f.....t.................:...........Z.....|...........c.................K...........0.....L...........'.....{.................X.......................h.................C...................................L.....p...........N.......................w.................<.............................1.......................r.......................l.......................r.................".......................;.......................>.......................+.......................$.......................O...........3.....J.................>.....\.......................2.................8.....T..........._.................;.......................;...................................:.....Z...........X.................F.............................).....v.................>.....k.................k.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\gu.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):956384
                                              Entropy (8bit):4.455345909186297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D78D3F526EDCEF1C7923475F99DDE3B2
                                              SHA1:613FC2E4B43DDCCB4EDD2F16903C3860B8563188
                                              SHA-256:86B9C50EF9CD617F969AB66F1DBB4F95A6A2E7EFB588707403F35B4E84330B6D
                                              SHA-512:0EDF39DD4F11F29E6927F88FA13CD0059E1C59653E0833F1FD21266D2E764D6FC127D9C3541A854D373E25F6949094B91ED83A18F9EDAB7BA88E93E6D0198129
                                              Malicious:false
                                              Preview:......... ..e.J...h.V...i.p...j.|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....l.............................R.....O..... .....\.....O.....................................................Q.......................7.................b...........L.....l.....O...........j.......................F...........^.....2...................................'.....$.....................................................$.....`...........@...........5.....]...................................................................................m.......................3.................Z...........e.......................L...........;...........B.....k...........p.................q.....R.............................d.................).....l.................G.............................#.....V.....}...........x.......................,...........l.....8.................. ....c!.....!.....!.....#.....#.....$

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\he.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):602433
                                              Entropy (8bit):4.7884870034691005
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:16970B0DFB5555779A8CE95D96BF97F2
                                              SHA1:432C8BCA1953C5719E4CA4310FA5558436103D6D
                                              SHA-256:C7B170DCF4DD84C2EA8A454C5D82D7F0C9AD9A98127E66263FC3CE0D91952254
                                              SHA-512:D20AFC7C4C648266C96CD38B8A27479884AD1C31C8C9C7B6FF7AEF14331B72EDC2E505BF83A25A767B5889FDF504649140EFF69EF7478A5DF7F04B1F507617AA
                                              Malicious:false
                                              Preview:........! ..e.0...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....].....v.................q.....'.................[.................2.........................................U.....w...........l.................9...................................1.....a...........x.............................g.................}.................e...........,.....E.......................9.................J.....w...........a.................=.................,.................^.....q...........g.................6.......................g.................'.................P.....c.............................{.................3.................2.....V...........M.................[.................S.................<.....U...........8.....i...........(.........................................8...........`.............................V.....}...........i.................r..........._.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\hi.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1008891
                                              Entropy (8bit):4.429572949324661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1E0B6E2E70F684C3D31795392F445E0E
                                              SHA1:D09B97D9D82119CBDCB2DC54816A0036B0188871
                                              SHA-256:D3F548279F8FA875B7F9918C19BD0D2760CBC126682E1270E3CB90D780A6EE50
                                              SHA-512:FBB275084BB3D6F62A5D0965AA56982E55D2B9471AD54670433421E2F5DFCE3B32EC4DEC75F235B907A436A0329CD0739F492ABEB5B38E349EB03F6F6A31A012
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................*.....O.....z...............................................?.....z.........................................^...........`...........n...........V...........Q.....t.....[...........^.............................\.....6...........f...........v...../.............................\.........................................Q.......................:.................K...........%.....>.................:.....k.....*...........<.....[.......................'...........z.......................Z.............................d...........P...........H.....t...................................F...................................s.....'.................5.....).............................y...........R.........................................c.................. ....V!.....!....."....^#.....#.....$.....%.....%....\&

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\hr.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471753
                                              Entropy (8bit):5.511235500490613
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA4907C0D4CDFF16C22294C962A8400
                                              SHA1:4D60838FE85A2E02269D107DFAC82E9206202640
                                              SHA-256:FACD97D583B2047C4AF1C230F77ECB031495376840229E0CDB2AD463F3EC7FBA
                                              SHA-512:23FB9358B57FB313CD76CAC03E19E2A40074ACF37CE23F8138C1A13FD571EDC8C80AFBE9172CBDC2DE367004E05A7E34B26F00B13BA17DB003B3A9321C7B207B
                                              Malicious:false
                                              Preview:........S d.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...|.Z...}.l.....t.....y...............................................................................................o.................\.................-.......................{.................2.......................................................................6...........3.......................u.................5.......................W.................1...........J................./.............................Z.....|.......................@.....P.................J....._.................<.....K.................N.....c.................6.....F.........................................i.................$.....F.....c.................).....I.......................6.................[.................7.....\.....r...........?.....q.................k.................c...........>.....P...........8.....v.................].......................:.....X.....j...........F.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\hu.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):508122
                                              Entropy (8bit):5.631450824927112
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BD724FD924C465E0335F444B09413970
                                              SHA1:E5A630E412985FC9393456F48869EC6B4286AC3C
                                              SHA-256:18DA515A2174A5FE97F0DDF58AAC49911BECDFF848D0AEA9C7A3B22E526C548D
                                              SHA-512:F2A8937DCD17FEE6ED92380735A94123CD19C8EA967C1E8BB6747A482B68FBE47A08AE8482C92E2DAA688509BAE78F0D5E51FD5FDF4940770FBE6354AFFD0251
                                              Malicious:false
                                              Preview:........$ ..e.6...h.B...i.S...j.]...k.l...l.w...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...................!.....).....1.....8.....?.....F.....G.....H.....M.....].....s.................J...........k...................................\...........B.....\...........T.......................}.........................................q...........#.....T...........{.................i.................0.................Y.....i...........l.................a...........M.....l...........`.................................................................g...........C.....Z...........d.................4.................!.................M.....b...........h.................9.................4.................?.....[...........&.....R.....{...........B.................*...............................................w...................................Y.....z.......................*...........Q.................i...........0.....L.................K.....g...........X.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\id.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):422094
                                              Entropy (8bit):5.375243450232671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A4408935D4D1AE307034321C166C999A
                                              SHA1:14061D4DF638097B16D388A4CB48BAE69682E755
                                              SHA-256:5D94B52213ED07C3D45F221EDDFAA86312296BEBEB2B79FA3CE693F7B3A20B8E
                                              SHA-512:6A44CE38797C5317C13BDD4B999452A5ADF2324C01C59833051AA564166F64E0BCF70EFCE66CA4BAFC5388E1CF810DB28C9711667D021BCD6806572EA91F0809
                                              Malicious:false
                                              Preview:........) ..e.@...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....d.....q.......................y.......................z.......................z.................;.......................>.............................`.......................W.......................b.......................N.....x.................-.....Z.....g...........-.....h.....{...........V.......................3.....N....._.......................#.....q.......................J.......................1.............................Z.......................3.....`.....l.................L.....Y.................C.....U.............................X.......................0.....v.......................Z.......................1.....K.....Y.................9.....H.................@.....Y...........Q.................'.......................:.............................Q.....p.................?.....v.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\it.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):471606
                                              Entropy (8bit):5.271836469512455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DDA6C80D323CF717B7D596292ED60628
                                              SHA1:22193A23952ECC7F37AA5DB98AC369B7E1AA7508
                                              SHA-256:622EBAC5319BE333D3415DE6571F79D48A23792B6E9DAEB4080B492EEC99D8DA
                                              SHA-512:741C817CFE404C96BDEAE902A6CE1BA77179742593202E3276F81473E7957A557C7AB40E5275469F41186F25D977F3811FC5714B9A7907776E91E929F879E8FA
                                              Malicious:false
                                              Preview:........E r.e.x...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.#...y.)...z.8...|.>...}.P.....X.....].....e.....m.....u.....|...........................................................q..........._.....{...........@.....................................................O.....x.................7.....E.........................................4.....^...........V.................@.......................a.......................~...........'.....@...........:.......................[.......................?.....i.....w................./.....:.................D.....V.................2.....=.............................`.......................9.......................B.......................n.......................=.....r.......................L.....x.................i.................K.......................&.....d.................2...............................................$...................................?.....U.........................................".

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ja.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):564410
                                              Entropy (8bit):5.833338590437962
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ABC924058F1AD7A374677AEAE49A12F8
                                              SHA1:948F5F2600A23F93F1D30A38408DEE80D7C5A5E2
                                              SHA-256:B33F0FCBD0B4A2BFE49E4607C0CF25B93B99A0AA4BF6A337E1EF6A7842748D3F
                                              SHA-512:C813567EC1776B20933912176EF0D4050F972ADC24B6EC9151C4E390EB696650773914F10502876B23ED5660547672810C6D4C64659DCB169706817BA4ECCBF1
                                              Malicious:false
                                              Preview:............e.6...h.B...i.M...j.V...k.g...l.p...m.x...o.....p.....q.....v.....w.....y.....z.....|.....}...........................................".....*.....1.....8.....?.....A.....F....._.....}.................Y...........7.....U...........K.................;.................9.......................F...........6.....g.....y...........G.....t...................................n...........2.....S...........3.....f.....v...........Q.......................r.................a...........c.....~...........B.....d...................................o...........7.....X.........................................`.....o...........k.................5.......................~...........J....._.........................................F.....h...........M.................%...................................X.................J.....l.....{.............................U.............................G.................\...........*.....K..........._.................E...................................b.....}.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\kn.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1085178
                                              Entropy (8bit):4.3593010164581925
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15A61AD50E2FB3833AC6A393A73F8488
                                              SHA1:6F603577883B716F792301F8FFFDEFDE3ACD8FED
                                              SHA-256:D08672BCEBAAE44591C08AA57C5B3511E0760027A39B6EC13F345F9DCB7C2BFB
                                              SHA-512:25E1473A54D9288C96BF64CDF7FCF5FC9E695A1A11A048143AAA83C3308AB215A1E0B362E257662B3D2D6E736C45A0E4BC8126A67E0D2274E0A9C8F236B62EC3
                                              Malicious:false
                                              Preview:........I n.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....}.....................................................G.................F.....G...................................^.....x.....R.................r...........O.......................,.................c.............................z.......................!.....'...................................K...................................t...................................e...........V...........;.....N...............................................Y.....-...........b...........9...........\...........`.............................>...........................................................G...........j.......................I.................0.........................................F.....v.....B...........! ....v!....2"....."....M#.....$....4&....2'....g'.....(.....).....*.....+....L,....1-.....-....$............/.....0....@0....s1....\2.....3

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ko.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):477276
                                              Entropy (8bit):6.165762910369141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BDFB8A270C4B8786C8FC2B8A1CB60BAB
                                              SHA1:EC240169AED1CDC91030298C63824C053DE51205
                                              SHA-256:1CBB36AB058A27954F4BA1AF2778A4164FFA1719835C8A8E721722A3837233A7
                                              SHA-512:E22F7109C4DA972E4C138B36D30D3D589058E8418F260707D013A4A28F7D444B1C0213626DB1A8F2A3B9BB83467721493C26FB6C8A4D3305FC5CD9FCD1D42FE7
                                              Malicious:false
                                              Preview:..........1.e.....h.....i.....j."...k./...l.7...m.?...o.E...p.L...q.R...r.^...s.o...t.x...y.....z.....|.....}...............................................................................!.....4.....D...........8.......................x.................B.......................s.................0.................#.....3.................&.....9.................).....D...........".....W.....k...........&.....T.....a.................D.....Q...........#.....[.....k...........n.................7.............................e.......................@.....e.....u...........Y.......................w.................%.......................,.......................).......................G.......................z.......................j.......................u...................................3.....c.........................................................................................X.....f...........?.....p.................O.....~.................D.....d.....w...........9.....h.....{.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\lt.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507620
                                              Entropy (8bit):5.627043956013093
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37274D5FBCD7DFD0778ABFA2F95AC435
                                              SHA1:603B198724776B3284D202E4042EB24ABDAC3CC4
                                              SHA-256:5078AF2EF4D000CD3D8E886B907B2BA279D71477D7012FE3E54629CA3898E0A9
                                              SHA-512:962C8B533D2FBC2E6C668CB7FAA158170D534D35F2727861E27B360F25B7E83DC071B4460C93743BB1A5BB1E38CBEB975A97DC62EBA13E5861200FD1F77874CD
                                              Malicious:false
                                              Preview:........: }.e.b...h.n...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................N...........<.....W...........m.................g...........A.....[...........R.........................................[.............................(.....\...................................l.................-.................U.....e...........}.................n...........L.....j...........L.....s.................q.................&......................._.................0...........$.....^.....m...........k.................7.......................m.................)...........\.................@...................................K.....s...........e.................E.................5.......................A...........h.................[...........".....F.............................~...........@.....`.............................B.......................b...........2.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\lv.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):507292
                                              Entropy (8bit):5.62887128025288
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6901EBBD0B49837B20FC11A3356F9C66
                                              SHA1:1D45310BA36C0247CC6493CF6E095B7F80030A02
                                              SHA-256:E55EA11EB9D59AA2F3FCD1818C5F325DF7EAFAB833AD624311F59228667D8F82
                                              SHA-512:E825802FA38BA2F3855F86AC297BD808A71D8902CF1680CAB20F9FBAF6691522FA834599F97621E18557B11662B0424D6329984417C0FD102E9870F78A34B105
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.........................................................................................b.................O.................-...........b.................N.................>.................Y.....d...........Y...............................................+.....|..................................._...........%.....8...........\.................J...........@.....a...........,.....R.....h...........5.....^.....p...........C.....j.....~.............................O.......................z...........7.....F.........../.....b.....s...........k.................H...........;.....S.................1.....F...........E.....|.................k.................0.................:.................'.....@...........D.....y.........................................B.................@.................!.................V.....f...........8.....S.....u...................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ml.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1133266
                                              Entropy (8bit):4.387039979900048
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29845370C202A7C1FAEC4BD65D2856E0
                                              SHA1:70078AFEB8488FCB670ED3199E7853CFBA4FD101
                                              SHA-256:57496D8C0159DFE74FEE320E1CDE18FC1A8854991B764BE085CACB1DE9AC6AB0
                                              SHA-512:E544B61B41DAAA16E8A519AAAF6C58A42B6F341BA5A9109F74154E7B40CC97FA7B7FE5C678EEEB7DB5E9DEBC5E7903C4073D677EBDDF7B32A5B75C3F96A08F16
                                              Malicious:false
                                              Preview:........K l.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y...........................................................Z.................P.....9.......................M.................h.....W.......................s.................d...............................................y...........?.................c.......................b.......................+.....o.................z...........T.............................`.......................r................................... .................L...........d...........{.................d.............................M...........Y.....!...........................................................O.......................J.....&...................................................... .....!....P!....r"....i#.....$....J$.....%....K&.....'....I'....w(.....)....o*.....*.....+.....,.....-.....-....#/.....0.....0.....1.....2.....2....[3.....3.....4.....5.....6

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\mr.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):934541
                                              Entropy (8bit):4.4365640897236505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EAB367E9F45366FF6182DE9C989F0EAC
                                              SHA1:EDAE15CE3933672F25B73730B5E1FD9871F2B262
                                              SHA-256:208B8DE31DA311B8C720284A46D045DB952740293A2C01E2C3CFFC6A97CDA7A5
                                              SHA-512:61219D0B26D039F6996A8433B260FF059858CF872A28A462A6948F99B88FF288FDBEDD1E2523DA341E244C91FDD9FF4C80C72C202D746CFD2ABD59D202602F11
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................".....).....*.....+.....0.....R.....t.................7.....o.....-.....i.................\.................%...........L.....R.....O...................................8.................8.....X.....b.....@.................z...........................................................u...................................d...........q.................{...............................................\...................................:....."...........a...........T...........u...........X...........q...........d.............................!..........."...................................H.....~...........l.....2...........................................................W.................. ....R .....!....a".....#....G#.....$.....%.....&.....'...._(....i).....*....w*.....+....^,.....,.....-.....-................&/....G0....;1.....1

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ms.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):440491
                                              Entropy (8bit):5.26850729829571
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:47C581BA86F8E8ED064C6F2C2528E39C
                                              SHA1:F5F78898490A2A355BBAE157EAB716B29F755C81
                                              SHA-256:57F48C9B4DFCD9406909230689C9C0028704DF2D708F9CC30E92CEAB244C6E39
                                              SHA-512:DE989540872F75022E9963BDCDBCED7CFB393FD5CE5F860A546AB946A00F9253500032B3A8F214768829829C0CA666A3BC967A39331D00BB9B10393EE3BCCFEA
                                              Malicious:false
                                              Preview:........T c.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.+...w.8...y.>...z.M...|.S...}.e.....m.....r.....z.........................................................................................[.....w...........6.....j.....z...........X.........................................9......................./.......................1.......................W.................(.....x.......................U.......................C.......................`...........-.....?.............................I.............................o.......................i.......................q.......................g.......................U.......................H.....{.................i.......................j.......................J.....n.................'.....P.....a.................E.....h.............................}...................................#.....<...........3.......................d.......................q.......................A.....c.....s...........!.....N.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\nb.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):431086
                                              Entropy (8bit):5.412510838847386
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:206FECEE346302A44737681661A419D4
                                              SHA1:0CBB4EDD9CB8EF23746242D16717D2042C3254D0
                                              SHA-256:2D7103F4B60C185F0EFEA040D23F5040C8EE405F6E02DA2B38C894AFC29E0832
                                              SHA-512:C4A8C92F98F6A3D5792DC3CA50BC4552060979FEB269BFA18422B68787505361864CE548D420AED0BF600EEDB64B1EC96860D3DC962AD5F910A52F6E3A2CDFA0
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z."...|.(...}.:.....B.....G.....O.....W....._.....f.....m.....t.....u.....v.....x.............................T...........G.....\...........%.....^.....q.............................Q.......................R.......................@.......................A.......................m.................5...........B.........................................X.................7...........W.......................b.....{.................7.....\.....l.................?.....O.................N.....b...........".....P.....`...........(.....Z.....j.................F.....V.................B.....P...........:.......................H.....n.................,.....K.....d.................3.....E...........2.....q.................\.......................h.......................o.................,.......................y...........?.....h...........0.....\.....o.................(.....6................./.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\nl.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):443233
                                              Entropy (8bit):5.354406946962274
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9FF1D4EB5F94297FDB8619004C0CACF8
                                              SHA1:FE149C387C18D5B2F63A30C49019E7FD8AB913AB
                                              SHA-256:6DA873B61E1DD29ADE307EB1ACF1834728CFEF98CC701A475CD360E493380380
                                              SHA-512:89BC1FACD343FD35BF1C10994422826E97291634C9DFF45CE55F7BF620261DED041F9F8FF3AADE4DA082B915212594F45C99133BC20274C660DBD6B1FB7894B4
                                              Malicious:false
                                              Preview:........0 ..e.N...h.Z...i.k...j.w...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.&...........3.....;.....C.....K.....R.....Y.....`.....a.....b.....d.....p.......................1.........................................0.................\.....r...........?.....u.................7.....`.....o.................C.....Q...........).....`.................Y.......................n.......................}.................;...................................C.....\.......................3.............................U.......................D.......................F.......................+.....~.......................].......................R.......................q.................*.............................f.......................T.....|.................`.......................e.......................[.......................p.................V...........,.....=...........+.....m.................].......................F.....j.....z...........<.....j.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\pl.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491896
                                              Entropy (8bit):5.733819464813427
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3AC2084834A61A90B33F64537E3B1F27
                                              SHA1:72DB3F2DAF8EE32CF224D9CF905C2D6E828C2D71
                                              SHA-256:791D2F53FA305B4929A76DEAD75FAFFDC367B5C4CA79CEBBAD71D79FEC0031E2
                                              SHA-512:BDF19FD085035916FC745D00BF9DAEA34D703BC2C6F669D21E39AAD5C8AD05500088878EBBD2B86B80696E93EBF7DE3143DB078B25A98251CA2C8525F6E88141
                                              Malicious:false
                                              Preview:........Q f.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{...........................................................................................................o.................N.................6.................:.....P.................1.....E.................D.....V...........-.....c...................................\.......................r...................................b.....~.............................k.......................+.....w.......................=.....^.....l...........5.....n.................=.....p.................7.....h.....x...........#.....O....._.................O.....`...........J.......................I.....f.....}...........&.....G.....m.................].....r...........D.......................].....{.................E.....k.................d.................F................. .................Y.................>.....k.....|.................+.....:.................P.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\pt-BR.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):463221
                                              Entropy (8bit):5.420005926145208
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B90235085171D3331791C016D3C9B22
                                              SHA1:8342C7C34EE6824D6E124ED16F6F9CE93B1AA8C5
                                              SHA-256:F5D1F8357CB40F5C8E3B84C2FADE5B41636A931D4B047122489BD0443A43E1E7
                                              SHA-512:264186B540D55629C4CC44AF4FC4D0F1F096F575250FC16FC6621299842367DB424595FBA4F0CCE63812ECEE563966D100AD7B7D0C7346BB60C2159E09FFE4B4
                                              Malicious:false
                                              Preview:........H o.e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...|.D...}.V.....^.....c.....k.....s.....{.................................................................~...........f.................I.................%...................................-.....B.......................".....x...................................T.................y.................T.......................y.................*.................e.....~.............................O......................./.......................-.......................0.......................3.............................i.......................C.....q.....{...........8.....p.................|.................:.............................U.....{...........,.....W.....o...........h.................L.....q.................R.......................m.................W...........+.....A...........B.......................i.......................A.....g.....|...........T.................".

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\pt-PT.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):466574
                                              Entropy (8bit):5.393834079901674
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:072E2BF5C2C23C26A342B1CD5090ADB0
                                              SHA1:F60997D94FDF3A2A3892722750E8533B7D68CC59
                                              SHA-256:ED87A5C64BF2C5D57A2DD7B71C8A338E0A5402AD7B6EE731773601E885FD01CF
                                              SHA-512:DF8B3407AA31D3E46218D2E277359E32BF3C6623A54CD2400743BE6432210FCCBA82E92EBDBCA0F44F322A4E7BA7FF4522E779816E992BF40C08E426BDE498D5
                                              Malicious:false
                                              Preview:........U b.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................n.................T.................=.................8...........#.....g.......................X.....h.................<.....N...........<.....~...........".......................\................. .....{................./.................M.....b...........X.................-.............................r.......................u................. .......................(.............................i.......................B.....o.....y...........0.....d.....u...........S.......................c.......................(.....B.....S.................D.....^...........7.......................M.....w.................7.....m.................C.................1.................$.................[.................b.......................V.....{.................^.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ro.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):481152
                                              Entropy (8bit):5.445989518263063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72F4A085F0FF9435A99E52CE890710ED
                                              SHA1:D5AC32EB03273B8463D42EFA97712DBE9732B28B
                                              SHA-256:74589FEA8304CB7DA427AB5E5DC71E18F3B1096A0C62B5569B539A08BADF6D6E
                                              SHA-512:29BB40648A59277F35F5AEBD321D6F5C2666756A821F67ACE74EBD222BC3B2A0F4CD2B138C0CEF008AD76D6019095F54D61C9B30AB4ACF64F3ED508B13FB3A03
                                              Malicious:false
                                              Preview:........6 ..e.Z...h.f...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....M.....U.....\.....c.....j.....k.....l.....n.....}.......................;.................3.................-.....A...........H.................9.......................Y.......................<.......................K...................................F.....j...........H.......................l.................'.......................x...........H.....v.................3.....P.............................p.......................U.......................R.......................?.............................e.......................M.....|...................................G............................._.......................d.................1.......................n......................._........................................./...........,.................!.......................n.......................r.......................t...........3.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ru.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):765340
                                              Entropy (8bit):4.963754533847095
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F7AF63DF54FD846C16B3C97E588FD3F
                                              SHA1:7622045E2EA5D5A690A814873AC17B3CE57E6035
                                              SHA-256:EC13F5B2DAE5F7577F482762A47D2120AE318AFB2D35A073D809F740F6937BFC
                                              SHA-512:EB0B6C23A4A28049FC0E9F8AEB3639AEB36CE6A0AFAE570680FC9EB7752F8571AC8F06E92EFCC325311CE4BB0C4DE7E54C2F2CBB7109F451D67EAF0179F187BD
                                              Malicious:false
                                              Preview:............e.T...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j...................................d.......................F.......................w...........'...........5.....z...........c...........k.................@.................O...........A.....}.....p.....3.......................@.................n...........O.....t.....,...........V.......................".....P...........c.................Q...................................0.....M...........R.................V...........0.....U...........X.................2.......................u.................4.....F.......................G.........................................$...........?.......................a...........*.................9.....K...........z.......................2.......................U.............................N...........L.................'........... .....Y.....r.....J...........g.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\sk.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):491754
                                              Entropy (8bit):5.793671440598259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:56F9681FE00C2C813332B540349B8C26
                                              SHA1:838EA31D9C62413ED2F9A1001A9DE6CDFD629585
                                              SHA-256:5C6239569CF39699A77AEC0D6E418EABCB1E4A5B1C504676B9C9729B59214480
                                              SHA-512:2D204D9C166CDA23E9994EAF5593B017CC8E2337F6D5F9BAAB86548F04CCEE04C12E85E15149C8B1F99A071CDAC0AF1F20DF1D9F0BB91595B93C45CD7D99123E
                                              Malicious:false
                                              Preview:........B u.e.r...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...|.;...}.M.....U.....Z.....b.....j.....r.....y...........................................................~.....#.................'.......................q...........E....._...........0.....i.................O.....~.................J.....s.................`.................U...........!.....D...........;.....v.................r.................E.............................;.......................].....}.................S.....y.................L.....s.................e.................#.......................8.......................I.......................h.................)...........C.......................F.....a.....u...........*.....F.....[...........%.....].....m...........j.................?.......................C.......................c.................*...........e.................`.................).................).....=.......................".................[.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\sl.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):475865
                                              Entropy (8bit):5.477217061104823
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48D1A0F19DA57879F019D8B158574D97
                                              SHA1:F642DFCF4FA4EC008EDFE6A170350C0FCC7321D2
                                              SHA-256:7378E9E25C132B86D049D94A8284229F164CC3AD8C8E2426262172EB63C09BB3
                                              SHA-512:4061FB292F090108D7CF2DC05279A602E08D6F1DA3A85B5738BDE48AFB59F32BEC1D1871083E647FDE1881C04E3C0480EE372EFD62D89A8EE2B4A5169D21BFBC
                                              Malicious:false
                                              Preview:........* ..e.B...h.N...i._...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....h.....v.................+.................&.................-.....>...........J.........................................#.............................r.................'.......................g.................3.................K.....a...........5.....l.................z.................k...........<.....b.................(.....@.......................%.........................................<.....P.................J.....[...........A.......................S.......................W.......................s.................*.............................d......................._.................0.......................a.......................Z.......................z.................,...........v.......................6.................5.......................1.......................#.............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\sr.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):717149
                                              Entropy (8bit):4.90268618853934
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CEB5A570B85F1E7A385D7D3BBDC71A04
                                              SHA1:943B103639DD738DC17365DF90EF0B27BE35A728
                                              SHA-256:9BD132621993B3F2FE15A4BB8DA7A791A75CD340A0A819FFC2258E1384F2A58D
                                              SHA-512:0CC08A9FFA0940DEC5A740012997BD1D5C1F38A2106C125D63B8F7F4608EF1E6E7EA5926ADB49C0316D34CFCC9E80E5E6DC189740A93E0DC6DC77988959CA12A
                                              Malicious:false
                                              Preview:........J m.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v. ...w.-...y.3...z.B...|.H...}.Z.....b.....g.....o.....w.................................................................?.....,...........m...........e...........r.................[...........#.......................I...........x.................w...........4.....K.......................G.....G.............................-.................v...........o...........z.....1.............................i...........6...................................>.....a...........^.................y...........z...........I.................?...........X.................Z.................>...........m.......................[.............................=.....e...........t.......................&.....s...........`...........S...........F.............................f.......................G.............................K.....i.....W...........p...........t...........S.....t...........o.......................=.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\sv.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):432643
                                              Entropy (8bit):5.520056060273409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37BFD002B9A56B236A07B4BFECB6ACD
                                              SHA1:EB7687D66DC7195AEA46CCD52FFEB123B081E3BD
                                              SHA-256:3634CC48474C78ECA269AEBEA00CCE47CEDAEB2C1A522A30EEF3ED0013926923
                                              SHA-512:5D042CC92123F0389012C9618F6EDA666A97DA0FE83EBEF883BD2C032C1E937B9EA0E1F6C4BB5B0CED7E28F6C7BEBD2D9E73D077604DD66F8B1B280DA27A0A73
                                              Malicious:false
                                              Preview:......... ..e.....h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....A.....S.....g.....{.............................G...................................P.....i...........9.....r.................D.....s.................C.....t.................h.................:.......................m.......................w...........&.....6...........2.....}.............................;.............................h.......................E.......................9.......................F.......................;.......................+.......................".......................-.......................B.............................k.......................<.....].....o...........G.......................h.......................Y.......................O.....................................................7.....]...........).....Y.....l.................$.....2...................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\sw.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):454700
                                              Entropy (8bit):5.349003712537203
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0CEEBA9BC94F6430729C85AD9106926
                                              SHA1:8A268A2EA070E4D5BE6B0C19C41E01EEC4BA0D72
                                              SHA-256:53EDF339033BB99EA23BE682C15ECEBE6D78C4F8B64669E74B7008FB076DC678
                                              SHA-512:121536514ADEFAAF15E5232A4F70A4787EC428E123FAC9DAD5C6EDF5C2FFC5A112C1936D1FAE3C954AB11BBF52BB043C1B3AD5CE135886279CE69D5C05254F40
                                              Malicious:false
                                              Preview:........7 ..e.\...h.h...i.s...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.............................A.................&.................4.....F...........9.......................R.......................C.....n.....}...........(.....W.....e...........2.....f...................................a.......................o.......................p.............................,.......................L.....t.......................@.....I.........................................C.....Q.................6.....H.................I.....T.................+.....8.................+.....4.................^.....w...........*.....V.....r...........4.....e.................F.......................n.................D.............................l.................-.......................l...........A.....U...........7.....z........... .......................R.......................t...........'.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ta.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1128054
                                              Entropy (8bit):4.173066636042835
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FB43B1980819D75556A4C8C32FB4BD95
                                              SHA1:B6F81B27E147EC1BCB2E0D3BC1344115C7BECDDC
                                              SHA-256:8E7F08307C90BF61616888A57C05D7E1E6B0182D01F7ECA895AD79B2C00F337C
                                              SHA-512:DFDBE66644B31D6801F0C3C11739FB498D71B3B7CE40919A1277155A45181C0E251E9E3FFB84FDE225F801A52ECD0F245DF050612862A2B24B5DEA939FB31EE4
                                              Malicious:false
                                              Preview:........ ..e.....h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....u.................D...........?.............................j...........2...........d................./.............................Y...........t.....V....................... .................w...............................................E.....m...........A...............................................".....%...........B...........w.....S...................................C.....n.....x...........V.....M.....>.............................=.....k.....d.....T.............................d.................D..... .....d....._.....G...................................P.....% .....!.....!....&"....O#....]$.....$....e%....=&.....'....S'.....'.....(.....)....e*.....*....5,....H-....).....z.....f0....P2.....3.....3....N5....[6.....7.....7.....8.... :.....:....1;....5<...."=.....=.....=.....?....C@.....@

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\te.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):1043527
                                              Entropy (8bit):4.426337953995401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6B594588A6292B3D13269C23EA35231
                                              SHA1:3D098299EB245B24E49C3FCC178AE1D09985E265
                                              SHA-256:70A466AD6291A12F75347F552C15650A040D26EB415E04018D5DB25F0CEE398D
                                              SHA-512:2077492F072D0F384A3D9FD6963ECBDDC7A5A680283EBF965ACB888A47E1B4E90312A075A869F9BE51AF9760D4AABC6A5FB266D5F7252F998C35C3AD5211D87D
                                              Malicious:false
                                              Preview:........X _.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}...............................................................................+.....h...........Z......................./.....!.............................v.................%.........................................!...........i.............................Q.......................>.....t.....h...........?.....{.....r...........E...............................................7....."...........'.....\...........J.............................:.....{.................F.......................(.....o...........`.................7...........}.......................2.....v.................b.................W.......................Y.......................@...... ....9 .....!.....".... #.....#.....$....r%.....%.....&....Z'....8(.....(.....)....T*.....+.....+.....+.....-....P/.....0.....0....D2....U3.....4.....4.....5.....6....O7.....7.....8....n9.....9.....:....p;....k<.....=

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\th.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):883611
                                              Entropy (8bit):4.488277211018212
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1D7AE2CC0781852DF5AC948E761889B
                                              SHA1:9FF5B70558C26FF0C4A0A234DF662A9B5B00D11B
                                              SHA-256:1DF078BCD2D0FA247B1031A88CE2EFF27BACE693F8B85617D22E13E8DA21B73C
                                              SHA-512:825D13E218FF433C478188A4ACC90F84DD0D216A3F08A389091CD2DB3B2528B26BD75B143BB9F23BF02E21ADA7229093F85BF4ACF2A573F6DC8C8796521D6897
                                              Malicious:false
                                              Preview:..........!.e.....h.&...i.....j.9...k.H...l.N...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....|.....}.......................................................!.....(.....*...../.....S.....}.................3.............................X.............................`.......................U...........H.................6...........R...................................z.....q.............................J.......................^.......................l.................>.....-...........+.......................0.......................8...............................................9.................,.....P.................=.....d.......................'.......................D.....^.....[...........G...................................B.................`...........G.....w...........L...........R...........g.......................4.......................C.............................................................................@.....p.....&.................8.....A .....!.....!

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\tr.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):462528
                                              Entropy (8bit):5.606577668939973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B678783C319BCB892F839440A469130C
                                              SHA1:889D5379B23D8CBCA08968E469242E73725025BB
                                              SHA-256:045A38565C995C9B1F428295392F77052171BF4B1E7B327B921061C2BA7259FD
                                              SHA-512:18E8AFA27EFD25F87421A2CB5E9F34983D932AC61BABB171930BFBDA1186EC55BEEBDF110CA5BFBCADEC53D3EC41AF157E4FB7A2ECBE3B807AF1F12DD52355C3
                                              Malicious:false
                                              Preview:........^ Y.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.......................................................................................................>.........................................W.................-.................).....<.............................{.........................................4...........'.....j.................L.....~.................C.....m.....}...........i.................C.......................{.......................{.......................x.......................x.................!.................'.....8.................+.....8.................$.....0.................).....6...........;.......................h.......................[.....}.................B.....z.................c.......................l......................._.......................s.................z.......................4...................................`.....|...........@.....p.................^.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\uk.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):763471
                                              Entropy (8bit):4.999444806602008
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D03AD4371302B7FB9453E56E95D8781
                                              SHA1:4AD2A331D6F7D2D82D0F54328CF9A29F5CF8154E
                                              SHA-256:1395F97A60BCF82321118878292533103DEB43EE4823D6F7114F3F0D405EEC0A
                                              SHA-512:FCC24303E43039860EADD9D65BB790395AE706CF28358241D91BFE7E6C62E87F8A70E0069183208CB3681412D5AE8245891605CEE93C0DCDDDD91367168890CD
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j.#...k.2...l.=...n.E...o.J...p.W...q.]...r.i...s.z...t.....v.....w.....y.....z.....|.....}.........................................................................0.....I.....s.................\.......................U.......................c.......................~...........-...........P.................n...........Z.....o.....+.................P.....=.......................m...........g...........5...........).....J.................(.....U.....D.......................X.................'...........0.....p.........................................<.................Z...........4.....O...........`.................R.................7...........J.......................x...........C...........U...............................................3.......................p..........._...........`.................h...........,.....Y.....0...........6.....b.....T.....(...................................].........................................Y.....v.....J...........f.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\ur.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):673161
                                              Entropy (8bit):5.277859283772137
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:93DB2C0625CC25A0160268DF1E8D7DB0
                                              SHA1:63460D6C4A93F8DBF55A768F82B61A202186198C
                                              SHA-256:AD15FB814C172D8526DF00B7B130435F3B14581116F9FDD6368593E6AA2D128F
                                              SHA-512:C258819E2E84F771533E66BB3F82BBF68E23E0FDB1CEF7DC655E058DA6ED5612331AAED8BBEF55AB1E37D135BB8D754F1F9BE4E6687695D21C20662254FCAAEB
                                              Malicious:false
                                              Preview:........; |.e.d...h.p...i.x...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t...................................~.....................................................9.....n.....!...........(.....L...........W.................Z...........&.....I...........U.......................(.................l...........\.....{.....#.................<.................I.....u.....S.......................N................. .................H.....j...........S.................K.................=...........\.................^...........%.....A...........=.................(.........................................*...........:.................0.......................y...........9.....Z.....!.................\...........].................i...........D.....j.....<...........6.....g.....7...........n...........v.....#.......................C.................m...........).....V...................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\vi.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):542659
                                              Entropy (8bit):5.812552118931453
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B6AC1037F684BD0F61BBA25D03DD493
                                              SHA1:44AAE042D51BC1F726A56911BC71D9862E640062
                                              SHA-256:502E1846C3CC6CE0484AF890F92F69CDFBF0F5A98B8211CD551C03FF858A1A0F
                                              SHA-512:BC290D62E563883ED04CA4F4F5709DD1ABAF139D11A54FE5E3E44DA807C194B85778795058A474C87166FC0442C9B2F1FE22DA20353CD764A46AD850B9BF9E55
                                              Malicious:false
                                              Preview:......... ..e.....h.....i.....j."...k.1...l.<...n.D...o.I...p.V...q.\...r.h...s.y...t.....v.....w.....y.....z.....|.....}......................................................................... .....1.....Z.....y.....1...........O.....k...................................$.................9.......................t.......................i.............................:.................w.......................C........... .....2...........1.....}...........9.................F.......................&.................!.....@........... .....J.....[...........;.....w...................................P.......................e.......................z...................................=.....O.........................................I.....h...........=.....g...........^.................]...........Y...........#.......................q.................>...........8.................W...........m...........F...........D.....~...........g................. .......................m...........U.....v.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\zh-CN.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):400903
                                              Entropy (8bit):6.739635196638547
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2846F59BD7FC670307E900172A74272D
                                              SHA1:9AFD950370B9FDC4831C72864348B8FFAE36B6D3
                                              SHA-256:A1ABC5A22BAC57253082C9BC15645EFEEFE60B4F0A82ECBFD316D620DA49FE89
                                              SHA-512:F38C107FD60DE563A09EBD9A71D6F96F14102DF467C58E51560C274BF426EBB6D5D3EDE6955AFE5DAD17DFDF1227368AB964AC326559DDE5C1991F787C0853C0
                                              Malicious:false
                                              Preview:............e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w.....|. ...}.2.....:.....B.....M.....U.....d.....i.....q.....x...............................................<.......................m.......................k.......................v.................,.....z.......................R.......................1.......................1.......................M.......................>.......................$.....|.................+.............................q.......................8.....^.....j.......................,.................4.....F....................... .....y.......................^.......................6.......................9.......................J.......................!.....o.......................b.......................E.....y.................(.....B.....N.................0.....B.................9.....Y...........B.......................h.......................e.......................-.....K.....[.................;.....M.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\locales\zh-TW.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):397474
                                              Entropy (8bit):6.746352572041569
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D91E515657D4A3AC135214B6152BDED5
                                              SHA1:26EF564AB9326BDE96C038B769F110F80BB01BA0
                                              SHA-256:4126E6EE9F924F86046ED00C410B37543545EFB4D0E99E4FA472987D108B4CFE
                                              SHA-512:7B3A361C1ECC11A36EA9D92C4FE1DB85F3F53B1656B145289224A85270535E35A3E3E791D23D331A2DD09EBE18ED190A16FF230B56A8CC327E090F69EC6CBB11
                                              Malicious:false
                                              Preview:............e.^...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....M.....T.....[.....].....b.....k.....w.........................................(.....}.......................r.......................f.......................M.....v.......................?.....L.................".....<.................(.....=.......................+.....~.......................m...................................+.....=.............................;.............................R.....u.................,.....U.....a.................2.....>.................!.....-.............................W.......................H.......................>.............................J.....d.................H.....Z.................8.....[.............................\.......................G.......................P................. .................'.....<.......................'.....g.......................!.....t.......................f.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\notification_helper.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1257472
                                              Entropy (8bit):6.459845894027243
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4C20C7112B6E8BF10D7DF44D97840C5
                                              SHA1:17FFBE2E4CA78C8ECE222D0CD84D795F1CD5E1BB
                                              SHA-256:64C045C166D59F16DA04DB35B6FA4E4418C4B1A36379020D38D72F7CB7F86E31
                                              SHA-512:8DDFEBE870EA20754D36FFF6496BE798FDF5A11237416429494AE0A55D5F6ED527895D111C3F066FA2809D94E4E615F9EE878221567C1327E243C948A831DCDA
                                              Malicious:false
                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....d.e.........."..................<.........@.............................`............`.........................................p...\...........0..(.... ...............@......L.......................0...(.......@..............0............................text...v........................... ..`.rdata..............................@..@.data........`.......H..............@....pdata....... .......F..............@..@.00cfg..0...........................@..@.gxfg...@-..........................@..@.retplne.................................tls................................@...CPADinfo8...........................@..._RDATA....... ......................@..@.rsrc...(....0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\resources.pak

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):8178684
                                              Entropy (8bit):7.996793493800157
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:3E2E5EBB90FDD6540201009176A9BBFD
                                              SHA1:18AAF387D73A0CBE889C15FDCBD403DE18BE17CD
                                              SHA-256:B9C6C00F6D20A9F93EEF7341A1D036BAC8BB46501CC829AC12DD8787150DD488
                                              SHA-512:15FDF41B9D9A60D1D5377B57F4B0BBE782BD85828316E001C5CA06BADB0D23374E0FCD27294BF263DB31D8BED30A29C8250C03383C3385869279B56EDAC1DC84
                                              Malicious:false
                                              Preview:............f..:..{.PE..|.$H..~..K....3^.....`....R.....d.............................0.....W...........O5.....8....=:....f;....GD....]E.....G....+H.....I....AJ....vM.....s....mt.....{..........e......................2.........2;...7;....8;....E;....F;^...G;....H;....I;J(..J;.7..K;pG..L;.V..M;.e..N;.y..O;....P;....Q;....R;....S;A...T;#...U;....V;L#..W;.9..X;.S..Y;.i..Z;....[;....\;M...];....^;...._;.....<.....<.....<.....<4....<c....<.....<.....<.....<.....<.$...<$+...<,/..(=./..)=.3..*=.5..1= :..2=.C..3=}R..:=9s..>=.t..?=.y..^= ..._=U...`=....a=....b="...c=....d=.....=.....=Q....=E....=.....=.....=#....=.....=1....=.....=.....=.....=.....=.....=.....=.....=.....=.....=j....=.....=M....=.....=.....=g....=.....=.....=.....=.....=.....=+....=<....=r ..&>HH..'>.I..(>.J..)>wO..*>.V..+>7X..,>.Y..->j[..:>.a..;>.d..<>.g...@lm...@.o...@.q...@.r...@.u...@.x...@ty...@(|...@'}..BEP...CEl...DEl...EE....FE...GE0...HE....IE....VEF...{E....|E....}E...~E.....E.....ES....EK....EI....EH....EV....E..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\resources\inspector_overlay\inspector_overlay_resources.grd

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:XML 1.0 document, ASCII text
                                              Category:dropped
                                              Size (bytes):532
                                              Entropy (8bit):4.912769861588248
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E6229A8D1ECC4D9D6B49DC2986624285
                                              SHA1:0CAA0BDF14BE3C3E74ABEBA57D31A3DD0D58EB5E
                                              SHA-256:68760FC7002C3999D3B2AC6EB80FEBE28182134A0DD1D53829F660B3D96BC9EF
                                              SHA-512:764C3636877086DC5D30A7539AB01CD2D87979B5E0E34B5216F99F63BCF5B9AC216631525BD2A960F063F325820262D616053E36A8FFDD3BE67543B5D33963B0
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?>.<grit latest_public_release="0" current_release="1" output_all_resource_defines="false">. <outputs>. <output filename="grit/inspector_overlay_resources_map.h" type="rc_header">. <emit emit_type="prepend"></emit>. </output>. <output filename="inspector_overlay_resources.pak" type="data_package" />. </outputs>. <release seq="1">. <includes>. <include name="IDR_INSPECT_TOOL_MAIN_JS" file="main.js" type="BINDATA" compress="gzip"/>. </includes>. </release>.</grit>.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\resources\inspector_overlay\main.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
                                              Category:dropped
                                              Size (bytes):79113
                                              Entropy (8bit):5.556792880818279
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:893A2B9EDC9C85781D6FD211D52AB83D
                                              SHA1:A413A94C401BBE3634F92163D2806EE197F770AB
                                              SHA-256:6853E8DD17008B5E03DAD3F6D464EAA92BAF969345E305AFAE6FF3C3355BE93E
                                              SHA-512:1861B0D819F82EB4E45A62E9A72A0316D52E5B3AAFD5D9854F10D76E36E145E50AC9E1D2A38A091E9C4B0B44D4DA2B4717B2E1640D90552719F1E80ECB34CB9E
                                              Malicious:false
                                              Preview:!function(){"use strict";const t=new CSSStyleSheet;t.replaceSync('/*\n * Copyright 2019 The Chromium Authors. All rights reserved.\n * Use of this source code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\nbody {\n margin: 0;\n padding: 0;\n font-size: 13px;\n color: #222;\n}\n\nbody.platform-linux {\n font-family: Roboto, Ubuntu, Arial, sans-serif;\n}\n\nbody.platform-mac {\n color: rgb(48 57 66);\n font-family: ".SFNSDisplay-Regular", "Helvetica Neue", "Lucida Grande", sans-serif;\n}\n\nbody.platform-windows {\n font-family: "Segoe UI", Tahoma, sans-serif;\n}\n\n.fill {\n position: absolute;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n}\n\n#canvas {\n pointer-events: none;\n}\n\n.hidden {\n display: none !important; /* stylelint-disable-line declaration-no-important */\n}\n');class n{viewportSize={width:800,height:600};viewportSizeForMediaQueries;deviceScaleFactor=1;emulationScaleFactor=1;pageScaleFactor=1;pageZoomFactor=1;scro

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium\v8_context_snapshot.bin

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):642377
                                              Entropy (8bit):5.1998846752068415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:25F04D46B9A498FE87545046C6087056
                                              SHA1:1979BB74E2B33AF5B2B57E71E7676F009A04F4B6
                                              SHA-256:0CFE6903A57AEE9AF4BF5B7865CE75CD9A5D9BE5FECDA1965582A4E9E76A45F1
                                              SHA-512:1191F229107B060AB9BE96624CCBAADAEF892539000E27AF352A22215F590875028E27C34853905730E7A33845E0152F28E7B8B8EE45A42481EEDD58F601ADE1
                                              Malicious:false
                                              Preview:...........r....12.0.267.14.........................................................i(..i[.......z..............a........a........a........ar.......a2.......a...........rt....t...2u....u....u...Rv....v....w...rw....w...2x....x....x..(Jb...(L.....@..F^......`.....(Jb...,P.....@..F^..`.....H...IDa........Db............D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Chromium\master_preferences.tmpl

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):4971
                                              Entropy (8bit):4.688630860344496
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AE97F42BA3F28093353A1A8DE8D433D7
                                              SHA1:948F5A4A3EA43F95A42D4406F4BC6C987F6CD263
                                              SHA-256:7814CFF2B40FAA7CFF62F304EB3D5554A943E57A4DE2EA3C808C8622166A9F0A
                                              SHA-512:093D0759BAE618FC58A53254D2059432B0FB39149FEB5AC614DA84D6A21ED513972A213B8F799EAB903E8EA6B762E9174C125C7CF5CB0A310F1076CD6FD17B30
                                              Malicious:false
                                              Preview:{.. "homepage": "chrome://newtab/",.. "browser": {.. "check_default_browser": false.. },.. "distribution": {.. "skip_first_run_ui": true,.. "welcome_page_on_os_upgrade_enabled": false,.. "suppress_first_run_bubble": true,.. "suppress_first_run_default_browser_prompt": true,.. "do_not_create_desktop_shortcut": true,.. "do_not_create_quick_launch_shortcut": true,.. "make_chrome_default": false,.. "make_chrome_default_for_user": false,.. "import_autofill_form_data": false,.. "import_bookmarks": true,.. "import_history": true,.. "import_saved_passwords": false,.. "import_home_page": false,.. "import_search_engine": false.. },.. "sync_promo": {.. "show_on_first_run_allowed": false.. },.. "default_search_provider_data": {.. "template_url_data": {.. "alternate_urls": [],.. "contextual_search_url": "",.. "created_by_policy": false,.. "created_from_play_api": false,.. "date_created": "13242866705662805",..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.Native.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.879927360305737
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FBA237EEE9835FA8EF86AF92D9CC8CD2
                                              SHA1:6A0E87137EC33A70763E29AC70FD119EF2AF9CF5
                                              SHA-256:86AD0C89AFBFA047B23427B866141596449F44A89A8748B782D73315A25637CD
                                              SHA-512:6BAAA2CE92E318A12C144C48FFA1C0B8C169A7F6C72C4C7DCA82BABE3F4947685F5EC84E3DB72AA1FC70D27DB5AEFDE20A2F0D22E9DB024290342E98D1D999EA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x............."...0..............<... ...@....@.. ....................................`.................................C<..O....@.. ....................`......x;..8............................................ ............... ..H............text........ ...................... ..`.rsrc... ....@....... ..............@..@.reloc.......`.......(..............@..B................w<......H........&...............................................................0..7.........(....}.......}.......}......|......(...+..|....(....*..0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..*.......(....(....(....o.......r...p.(....(......*....................(....*.0..<.......( ....o!.....{......i(".....o#....{........io#.......&.....*........55......N..}.....{....o$...*.0..G.........(....}.......}.......}.......}.......}......|......(...+..|...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.Native.exe.config

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):186
                                              Entropy (8bit):4.942919098144707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9070D769FD43FB9DEF7E9954FBA4C033
                                              SHA1:DE4699CDF9AD03AEF060470C856F44D3FAA7EA7F
                                              SHA-256:CBAF2AE95B1133026C58AB6362AF2F7FB2A1871D7AD58B87BD73137598228D9B
                                              SHA-512:170028B66C5D2DB2B8C90105B77B0B691BF9528DC9F07D4B3983D93E9E37EA1154095AAF264FB8B5E67C167239697337CC9E585E87EF35FAA65A969CAC1AA518
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2"/>.. </startup>..</configuration>..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.Remoting.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):4608
                                              Entropy (8bit):3.936494912616784
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B7BA072AAEC4A86B5BD427DA28A51AE
                                              SHA1:FCD78D6A109703EB6C691263ADE979ECDC68CA46
                                              SHA-256:3B5E5FA773FD749C1429E56FC252DB0919BC698BD3084AF58760AAEE097DDA88
                                              SHA-512:DE6AB6B23AA81A2833E452059D373E321C9F121B82CBC330F3D726BC3828424D4C0B1E9F83D8124825A8A0E71F386C3A3D1BE4C3A35EC6189E4C3BA52FCD4CE4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8V............" ..0.............J)... ...@....... ....................................`..................................(..O....@.......................`......0(..8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................))......H.......P ..............................................................BSJB............v4.0.30319......l.......#~......0...#Strings....0.......#US.4.......#GUID...D.......#Blob...........W..........3......................................................K.........j.............................M...........................................................'.^.......................A.........'.............\.......................V...q.V...q.......................n.t...............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.application

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (550), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):1812
                                              Entropy (8bit):5.2113294172684235
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CACAE3835B5778B23A0A95E634D2BF29
                                              SHA1:5C3CF604C01A92970F12AD796E3CF6758FC98757
                                              SHA-256:1CD3F291E7BFA1BA96E522ECF36E7E849302A7925A106D572A93B9A763072E8A
                                              SHA-512:8DF153A438E0827FCACAE1DC7593667F5BBA80B509C235B55E3572DE48AA284079D70DAAF27C5BCCD97147FE59628A730025CC2EF8E4F4A46DCB274CEB17EDBF
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <assemblyIdentity name="Clear.application" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <description asmv2:publisher="Clear" asmv2:product="Clear" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <deployment install="true" mapFileExtensions="true" />.. <compatibleFrameworks xmlns="urn:schemas-microsof

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.exe

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):5407792
                                              Entropy (8bit):7.269144159853683
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:26AE5F1918D76D1221ED90C7183BDC84
                                              SHA1:404517A0671B41212A9332A195F339BA8E8355E6
                                              SHA-256:F685D405EE59002A2A8A08D98E129322ACCBB0C48153E19E4E1127A583E4BCFB
                                              SHA-512:0B33B03D4EF15653E3F0968D0F791306EA9342F4CAF0CAA9FB95C60799D4E37066DA335E6430B2B0C65BF9C91AB7C855CD6D69517B5DC2B303EA574000ADBC2E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t............"...0...Q..~......F.Q.. ....R...@.. ........................R.......R...`...................................Q.O.....R..z...........\R.0(....R.....H.Q.8............................................ ............... ..H............text...T.Q.. ....Q................. ..`.rsrc....z....R..|....Q.............@..@.reloc........R......ZR.............@..B................'.Q.....H...........d...............P^J...........................................{;...*..{<...*..{=...*..{>...*..{?...*..(@.....};.....}<.....}=......}>......}?...*....0...........u........|.,w(A....{;....{;...oB...,_(C....{<....{<...oD...,G(E....{=....{=...oF...,/(G....{>....{>...oH...,.(I....{?....{?...oJ...*.*.*....0..y....... ..a. )UU.Z(A....{;...oK...X )UU.Z(C....{<...oL...X )UU.Z(E....{=...oM...X )UU.Z(G....{>...oN...X )UU.Z(I....{?...oO...X*....0...........r...p......%..{;...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.exe.config

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):19624
                                              Entropy (8bit):5.015005614388246
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:427C4795260B4AECA74D6FA4AF6AE6E5
                                              SHA1:7FBDAF86BD9D5527EAF883AF701DC535C4CEA4AC
                                              SHA-256:5469472596BBE3058A2A89F1D5B0880A53A0A450159A240BD24F503B77B088D2
                                              SHA-512:CA00D0F23C7AD323C27CF109405F4E7310397632C19A49FD6B71E5A0717D927527470CB563F96A6B772FDD1AA5FCCFC230B6F5DE8B517835892A6F0E062C0FFE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="ClearBar.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <runtime>.. <AppContextSwitchOverrides value="Switch.System.Windows.DoNotScaleForDpiChanges=false" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Clear.exe.manifest

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF, LF line terminators
                                              Category:dropped
                                              Size (bytes):96683
                                              Entropy (8bit):5.257126320655635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C3757A5D36911A561AAA7E7A70E712B
                                              SHA1:E766D4835E1FDC89F22894CB07324FE9CE2E6972
                                              SHA-256:49110DCBD7ED10E54A5A5F6756CF179FEED6121EF9E9277C53C9DF8E1C6786EB
                                              SHA-512:A3674017867FD76225D525C8F59C02097639ED016024FAF73CC82D897DCBEDD02A16991DC504E707D69BD54E69029DC8E483F83C1DAD78E88651FC141D789ED0
                                              Malicious:false
                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">.. <asmv1:assemblyIdentity name="Clear.exe" version="1.0.0.1" publicKeyToken="0000000000000000" language="neutral" processorArchitecture="msil" type="win32" />.. <description asmv2:iconFile="clearbar.ico" xmlns="urn:schemas-microsoft-com:asm.v1" />.. <application />.. <entryPoint>.. <assemblyIdentity name="Clear" version="1.1.3.0" language="neutral" processorArchitecture="msil" />.. <commandLine file="Clear.exe" parameters="" />.. </entry

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Greensoft.TlvLib.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):8192
                                              Entropy (8bit):4.280980574705485
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B3C796CFC5C246A20207CF719C71C37C
                                              SHA1:A00511E18C3C8C72012F0C51E76BA44501969CF5
                                              SHA-256:9127EADFF877E7142AFB0E4239F77A52C47438A7A0A467E7744CAD07537DF04E
                                              SHA-512:2BDCE40BFA6C4B716AC637D7231744A5DC105DE8FF642D15552FFC3780984130FE0B5F553F29F9FD8B7BC868424CB5D5BF51A19E1C432E21BC375D8C90C48638
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............>4... ...@....... ....................................@..................................3..O....@.......................`......\3..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........%..@............................................................0................2.r...p......(....s....z.o.......3$..1.rw..p......(....s....z.........*.,..-..,.. ........X...b...`...3...._.....s....*..... ...._:w....s....*.0...........o.......3.r...ps....z. ...._-..s....*....._..-..........*..1.rC..p......(....s....z...+$.o.......3.r...ps....z..b...`....X.....2..s....*....0..............8.......Z.._d......._,...0j.,).-...._..3Sr...ps....z..._...@r6..ps....z.-.. ....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Hardcodet.NotifyIcon.Wpf.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):97280
                                              Entropy (8bit):7.267366315163259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C37391572EFAD4B7DF720123D7A35EA6
                                              SHA1:512B4EF31601998E3749223E067A96C95E3E3F78
                                              SHA-256:6B7A81F9A501F36FE050D94E57DC7456B1C63C58BFB214863FE9748A2A22D146
                                              SHA-512:6866D4995499ACF40D6102B2BDAB27B951879523B2FCDC61C40793811B1CED7130DAC2C9CB5B865268E8C4B2FA28AC5F92E4B4AEA81833A7AA262DE75B4AE68D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..p.............. ........... ...............................T....`.....................................O.......................................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Humanizer.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):308840
                                              Entropy (8bit):6.45239473803924
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C687CBDEA0138936FC4B88B3086207CC
                                              SHA1:93C188E269C21893DE07642AF022318ECAE31BAD
                                              SHA-256:2C522CD285DE2E3A02520F91203F548E454B980821F10DF90E801BD7D3F5C43E
                                              SHA-512:2692EE13267F1801D283B03DAA46CFA61E72E308CE441036F87E6A8492999113B5C82D89173E2E9E0DC64B0867592B24B031CE4E8652ECE4D3F281189C547F11
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u............." ..0.................. ........... ....................................`.................................D...O.......................h ..............p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H..........H................F............................................(....*..(....*V!...7....s.........*...0............-.r...ps....zr...ps.......i.I......+b....o....,H.......rY..p.o....o............rY..p.o....o....rY..p.(..........o.....+......o.......X....i2..(...+.*..0............i.I......8..................o!...o"...,)......r]..p.o....o#.......(.........8^.................o!...o"...,)......rg..p.o....o#.......(.........8..................o!...o"...,)......rm..p.o...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\LiteDB.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):488448
                                              Entropy (8bit):6.015215990524562
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BA42FE7DDCCC9DB8F8BFEFDF4178C67E
                                              SHA1:CC28125DEA3F4BF77A564E4E09A8B09BCD2AA446
                                              SHA-256:85B3596AD0E426646A774FAEC082E612AF0121A03CE8790412B6E6808CE2A3F1
                                              SHA-512:9843638E19D04B946830E7039BF195EED70A174F3F1A9DBF6F3612E18626CFC72E5B95858E1D1CAE3FFB4777D92738A2FB5A2CE53C4CDE1F6A854EEFEB94E5E7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H'..........." ..0..l............... ........... .............................._.....`.................................R...O.......................................T............................................ ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............r..............@..B........................H........c..<&............................................................{J...*..{K...*V.(L.....}J.....}K...*...0..A........u;.......4.,/(M....{J....{J...oN...,.(O....{K....{K...oP...*.*.*. 8..z )UU.Z(M....{J...oQ...X )UU.Z(O....{K...oR...X*...0..b........r...p......%..{J......%q>....>...-.&.+...>...oS....%..{K......%q?....?...-.&.+...?...oS....(T...*2.(U...oV...*..-.rE..psW...z.(U....oX...oV...*:...(....(Y...*:...(....(Y...*N..{Z....o...+(Y...*z.{[....{Z....{\....s]...(^...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Bcl.AsyncInterfaces.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):26752
                                              Entropy (8bit):6.512503595653532
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:970B6E6478AE3AB699F277D77DE0CD19
                                              SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                              SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                              SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.Abstractions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):48256
                                              Entropy (8bit):6.234996524588368
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                              SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                              SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                              SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Extensions.DependencyInjection.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):88192
                                              Entropy (8bit):6.25584016939133
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4186A905DC180A0CC2110403727BD792
                                              SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                              SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                              SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Toolkit.Uwp.Notifications.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):162448
                                              Entropy (8bit):6.204693784639812
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:805135DA62C5B65618B9782A5DC48F06
                                              SHA1:4F074C676E8A93EA4E618DB0E2AF4D5D2463AC17
                                              SHA-256:A0B5BE9580BF6548F685D79E5439F6D946EF57E013D201F946B2A894E7441804
                                              SHA-512:8594AEF25DB9E73DBAD999F6E4CBFE548FA82E41D94C6396F51213809BAB01B043C1238171CD44FC962E0F53050E4067A449AEEC07FD23B511A1003E71E2BB65
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....G..........." ..0..F...........e... ........... ....................................`.................................Qe..O.......p............P...*..........\d..T............................................ ............... ..H............text....E... ...F.................. ..`.rsrc...p............H..............@..@.reloc...............N..............@..B.................e......H.......l...p....................c........................................(*...*..(*...*^.(*......d...%...}....*:.(*.....}....*:.(*.....}....*V!..R{*....s+........*..{....*"..}....*....0..Z........(....o,...-.r...ps-...zs0.....(....o.....+..o/.....o+....o5...o0....o....-....,..o......*........*.$N......J.s1...}.....(2...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*6.|.....(I...*..{....*"..}....*..{....*"..}....*V.(....-.r...p*.(....*..(J...%.(....o>...%.(....o@

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.900655456226697
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:76B8D417C2F6416FA81EACC45977CEA2
                                              SHA1:7B249C6390DFC90EF33F9A697174E363080091EF
                                              SHA-256:5EAA2E82A26B0B302280D08F54DC9DA25165DD0E286BE52440A271285D63F695
                                              SHA-512:3B510CDC45C94BE383C91687C2CB01A501BA34E3FBB66346214FC576D6F0E63C77D1D09C6419FC907F5B083387A7046C0670377AD2E00C3EC2E731275739F9C7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Microsoft.Win32.TaskScheduler.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):333824
                                              Entropy (8bit):6.105576145657233
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A844AC745A4005FBD3F51D79FF88583C
                                              SHA1:92671774FD4BE9781A77D2788A8DDDBF8981EAD5
                                              SHA-256:74FE1A6A1E36BE7D893E31BBB4D4BD83BF4B927E715276CD5607982139818EBD
                                              SHA-512:5F0734058D9146FFEB552ABF443DF5097CF134A4737BED499467830E08D97F5D1996C1F1647C5C12289CA4D4209EFFD480010AFEBC59D50290D4CA7D45BB41F8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ..............................I.....`.................................0-..O....@.......................`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{....*..{....*V.(......}......}....*...0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(....*..{....*..{....*..{....*r.(......}......}......}....*..0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\Newtonsoft.Json.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):701992
                                              Entropy (8bit):5.940787194132384
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:081D9558BBB7ADCE142DA153B2D5577A
                                              SHA1:7D0AD03FBDA1C24F883116B940717E596073AE96
                                              SHA-256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
                                              SHA-512:2FDF035661F349206F58EA1FEED8805B7F9517A21F9C113E7301C69DE160F184C774350A12A710046E3FF6BAA37345D319B6F47FD24FBBA4E042D54014BEE511
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ..............................*^....`.....................................O.......................(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{]...*..{_.......-..*...0...........-.r...ps....z.o......-.~....*.~....X...+....b..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpClipboard.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27648
                                              Entropy (8bit):5.804767406769817
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27E89E536FDD09F8D2C5911C6B57AD90
                                              SHA1:1250FF1AA36A20528F7A489B5F29764E7D85CE40
                                              SHA-256:CBD69D92834309D6D1DB85489627ECFDEFC534E7E1DC1D6EC06B0BDF2723044F
                                              SHA-512:B942462FE3D313DAE64E0417D5C9E13137F467AA3C55343008111B1DAFEE465641FA9A5E7E160F863D1516E31AB34776C8AB2CF0FD02D8E966BA2C74A5EB45AC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w;............" ..0..`..........F.... ........... ....................................@..................................~..O.......d............................}..T............................................ ............... ..H............text...L_... ...`.................. ..`.rsrc...d............b..............@..@.reloc...............j..............@..B................%.......H.......d3..8>...........q..X............................................0..f........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( ......('.....(.....*...0..n........s....}.....s<...}.....s)...}.....s....}......}......}......}......}......}.....( .......o!.....('.....(.....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"...o#....*...0............{.....+..*....}.....{....%-.&+..~"

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Converters.Wpf.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):147456
                                              Entropy (8bit):5.921251663921899
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6B4D48DA8444E195EE9F7DBD54509050
                                              SHA1:93C7BF74A27D1721F5019F974EBDB23E4EFD77E9
                                              SHA-256:E3A24CB86E4C5C563A4C639E84A02F679752DFD9593076E6C4C2C79063BC580C
                                              SHA-512:D6C647C2F60A0C064A4507DDF95F3EE6BA45222A84DB824165814FA5044E2FC3D0DCEDBABA4334D4016AD2179CA6913B6505F5FF61BE443CAE871584E4FC8AE9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....[..........." ..0..6..........jT... ...`....... ..............................7%....`..................................T..O....`..............................LS..8............................................ ............... ..H............text...x4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B................KT......H........2..@...........LJ.......R........................................{-...*..{....*V.(/.....}-.....}....*...0..A........u........4.,/(0....{-....{-...o1...,.(2....{.....{....o3...*.*.*. Q... )UU.Z(0....{-...o4...X )UU.Z(2....{....o5...X*...0..b........r...p......%..{-......%q.........-.&.+.......o6....%..{.......%q.........-.&.+.......o6....(7...*v..(......}......}......}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..{....*"..}....*..{

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Core.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):183808
                                              Entropy (8bit):5.883721718575946
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:102AA7B6DF14A1B8BC85D63BA6324CE3
                                              SHA1:F67A2C49147395D254745CBA85D3B6C3BEB1F8D2
                                              SHA-256:DF734FE868BD7878F13E52F4DC3EE5DF47735991965D6640D91AAABEA85297C9
                                              SHA-512:F3A1B3F81C9A0A8BD7AD28CFAA7EE394D8486F21C5044559D8DCA66D5FBDB2FF7E5360F6B06F481CFD256F4F764ABF9C2101EE0B4EC6856A6D0C6322CBB015DC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rgj..........." ..0.................. ........... .......................@......9.....`.................................H...O............................ ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................|.......H........J..|..................................................................-....v....*.......uv....v....v....qv....v......*.......-....v....*.......uv....v....v....qv....v......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*2.s....(....*"..(....*..0............(......-..{.....o......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..).......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Css.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):91648
                                              Entropy (8bit):5.476131785053364
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2505206D82B85F5C8658441F0D100CDF
                                              SHA1:685D0A1AB32DF7B012E896F01CA76DDABCF67499
                                              SHA-256:3BC7D23F2F44AB3F7F8FF9E00289B49E6A5E990DA1F8DC92FDB138D6DA16B403
                                              SHA-512:F699F0E997F2F63F4533A0F7D436EEED99490DA7A944A8D99368661A5E8DEA4A5869DD2C3FADFDD8AF76BD97F226D68B6BFD9969DEF3597F340E539C159A1FD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..\..........B{... ........... ...............................b....`..................................z..O...................................8z..8............................................ ............... ..H............text...P[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................"{......H.......\...\....................y......................................2.~....(....*f.(.....s....}......(....*..0..G........o....-..*.(....,..{....,..*.j.+..{......o....o....,..*..jX...o....7..*..0..7........o.......o.....1%~.....o.......+.......(......X....i2.*2.{....o....*..o.....1-.{.....o....&.{.....o.....r...po....,...}....*..r...p( ...,...}.....{.....o....&*6.{....o!...j*....0..W.......~......{....o"....+..o#......r...p($.....o%...-....,..o&.....o.....1....o.....Yo'...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Dom.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.474871175289035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3453AB2CC06145E8B65FF572781DB0B2
                                              SHA1:12D6CE422A96D1FBFE62C07427C41EF446357229
                                              SHA-256:99EB1DC3D85D8AD6F6A443D621870E256C43A2DF6C7D9DEBE564FCE06ACFBF67
                                              SHA-512:FBDC6E62507E2C5B1B67B87114E65D4EF0C8C9F05FCEEAD1EFDD517415A5BFD5EE52A7E54A4D8DFF2016B361BFCEEED3BBAA0A6EFB2309F6067CF71FD29ADE76
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..|..........B.... ........... ...............................t....`....................................O.......|...........................8...8............................................ ............... ..H............text...H{... ...|.................. ..`.rsrc...|............~..............@..@.reloc..............................@..B................".......H.......x?..@Z..........................................................b......(+.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*6.{.....o....*V...(,.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*..(-...*....0............(.....o/...u......,...o;...*6.{.....o....*V...(0.....s....}....*>.{.......o....*>.{.......o...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Model.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):1072640
                                              Entropy (8bit):5.857610826427647
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5C0C906E41C10498072B74C065FF8FC5
                                              SHA1:B3F2FC11BCE6A10A4F402A964F03170952E36BD1
                                              SHA-256:785F8E36FE70214F3D5E36A1034AF65917C9ED9A157A6CBADF1642C240F4E736
                                              SHA-512:6AE9B9A8298FF540932D98E9734CCE40012BDE33753415E2A1171D7E036411F5287CF639E509A59DE3D0005BD946FEF457BC92EE1945973434C326E1C4A368B6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z..........." ..0..T...........R... ........... ..............................4_....`..................................Q..O.......|........................... Q..8............................................ ............... ..H............text....R... ...T.................. ..`.rsrc...|............V..............@..@.reloc...............\..............@..B.................R......H........@..................U...P........................................{M...*..{N...*V.(O.....}M.....}N...*...0..A........u........4.,/(P....{M....{M...oQ...,.(R....{N....{N...oS...*.*.*. $.. )UU.Z(P....{M...oT...X )UU.Z(R....{N...oU...X*...0..b........r...p......%..{M......%q.........-.&.+.......oV....%..{N......%q.........-.&.+.......oV....(W...*J.(O....sj...}....*f.{.....ov...,...}.....*.*J.{.....ow...,..*.*J.{.....ox...,..*.*....0..........(X.....(Y...-..{....(Z....+.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Gdi.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):113152
                                              Entropy (8bit):5.967666840143916
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:72D4D1734FE9492F8507219FD9D8DC64
                                              SHA1:970E9CED151576D9F8D7E52AA0F312A0059002DA
                                              SHA-256:986F96B0774CCE5A3A4389BC5E3D8C9B7A69D107B7DAA47607CCC41E20EA217F
                                              SHA-512:8E0E4B29D88ABE82CF856D9AC940A64BEAAF354A8E901ABF53A52C579E51D9BC969322E3CE3A6ABF8C7B45A73BD2BE41C74EC9E120B895D305308D6A3927E237
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*n7..........." ..0.............F.... ........... ....................... ...... .....`.....................................O...................................(...8............................................ ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................%.......H.......D................................................................0...........-.~5...*.o6...9.....o7...o8.....(9....... :..B...... .k[c5[.. _..,5).. '..;...... W..#;...... _..,;....8j..... ..K;...... 1H.L;...... .k[c;T...8A..... .n.w5).. ...l;...... ~LUo;T..... .n.w;....8...... ..B.5... ..P.;...... ..B.;....8...... i...;...... :..;]...8...... 8`..5u.. ...5).. .K..;...... .r.;...... ...;....8...... )..5... ~.d.;...... )..;....8k..... BB..;...... 8`..;....8N....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Rendering.Wpf.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):229376
                                              Entropy (8bit):6.015136394443516
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:57CDABE8A4465F184EE7C9F00F796996
                                              SHA1:27C70AF6271700FB3F84616C9EBEA155ABCB0604
                                              SHA-256:0712A1E8E2A9887DB18439DC3F3FDD6F8B367F514A47FB70A38FD6121C388E02
                                              SHA-512:BABDA13B581C9B09ED70C59C89C6F59C951F3B7F85D915702B47D3C7DDB7179B6C799BCB445A4E08C64977B047630EF465F77A1EC5DDE6D0D8385582B58B5622
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..v............... ........... ..............................eD....`.................................Q...O.......................................8............................................ ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B........................H...........L...........P...............................................2.~....(....*:.(......(....*..{....*..~....}.....(....-..(....,...}....*.s....*..0...........r...p(5....~....}.....o.....3 .o ...~.....{!...("...,..o#...,.*.r...po$.....(....-"..(.............o%....{!...("...-t*.o.....3H.o ...r...p.{!...("...,R.r+..po$...r5..p.{!...("...,5..r[..po$...}....+".o......3..o ...~.....{!...("...-..o&...-.*..0..M........rg..p(5....~....o'....r...p.(.............o%...o(....r5..p.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\SharpVectors.Runtime.Wpf.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):72704
                                              Entropy (8bit):5.973895173040258
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55E564E90852CDA28B7CAF06225832CF
                                              SHA1:CE049650E93CE17E737F86C28EF2165C7E256A6F
                                              SHA-256:C75ED43EE8DEDB510AAC00DB08851D54A6DBB16F38B804D5A69CF72A355C7672
                                              SHA-512:D99BE1899050252E7D10B71CF39BDAC897A254BEB12FFCD23E433D225D155E35FC3E6505AF47D681465AF6680D513D9692E761BFA855801C9DE07D4AF5A2E9FB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............1... ...@....... ..............................i"....`..................................1..O....@.......................`.......0..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......Pm..............d*......<0......................................f.#.......?#.......?(....*&...(....*.0..S........(#....($...-..#........5.r...ps%...z.($...-..#........5.r...ps%...z..}......}....*..{....*..{....*..{....*F#......X@.{....Z*F#......X@.{....Z*..0..6.......r)..p.{.......r/..p(&...r;..p.{.......r/..p(&...('...*^.u....,...t....(....*.*...0.. ........{.......((....{.......((...X.b*.0..2........-..*.{........{....()...,..{........{....()...*.*f.-..-..,..-..*..o

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.AppContext.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.887075475210058
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8CC4C7DFEB41B6C227488CE52D1A8E74
                                              SHA1:93702135DB0646B893BABE030BD8DC15549FF0C2
                                              SHA-256:9DC115AC4AADD6A94D87C7A8A3F61803CC25A3D73501D7534867DF6B0D8A0D39
                                              SHA-512:E4DA7E3AE5CA31E566EA0475E83D69D998253FB6D689970703A5AD354A2AAD1BB78D49A2C038F0A3C84A188D091696191B04E4A39253DEB3B6CB310B72F02F97
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ..............................ZY....@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Concurrent.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.941945190587086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:559C98EB9633C7BA1BC813F8E6E0E9A5
                                              SHA1:311F52B31611E6DC5FD4C0159BFA452C22980CA7
                                              SHA-256:CC62F3B867D50083C2932061F20662C698D2E1A741C4D2F9DF1FD2D435E3EF3C
                                              SHA-512:E241C16869D1CDBB2C6482A7C5B2AF93DE4BA0CEF8185B8826EEE35ECB174F35F7585C8AE0320F7F4F6B80F3BB5B3EDAE2383760F2F35637F03C3A0E38E0875C
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.NonGeneric.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.939816403058967
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:45FF71114047DBF934C90E17677FA994
                                              SHA1:526C688E71A7D7410007AD5AA6EA8B83CACE76C5
                                              SHA-256:529943C0CDF24F57E94BF03FAC5F40B94A638625027A02DF79E1E8CB5D9BC696
                                              SHA-512:29684AC5391268EAA276196A6249364F6D23ABFE59BDC304A561CF326CEA6CD662FA04C05E15924FD6D3F9E9D1607992B8DCAD3F817CFE891580F9D9462FE9B7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................>....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.Specialized.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.942827969586567
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B52C339601CB264F83DF72D802E98687
                                              SHA1:8BBB7BADAAA912C1F17775E9ACDCAB389704C772
                                              SHA-256:938DA38561DA54793944E95E94B6E11CF83AACD667487297D428FBCE1C06DC9C
                                              SHA-512:287F08AB07827570F9F3EF48A6D7E5C186899A2704FB3DBAF36975F6BE7B29FB6695A69FAB85A6F09BDDEFB60C79052C3A33CF862651F892EB9D773D880B3AF8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................>...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Collections.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.848992181946284
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1D8AAFECA1EA565B257384D3F64864B0
                                              SHA1:4D923B100142AFA2E0A8B7ACDB3A6DE6FEB91148
                                              SHA-256:C2250E9E51B44D8AB8C5B892592766925F6580EE00B95026621D0AFB037C2707
                                              SHA-512:99E4A226E1FABB348E7EF7C6FA56AD0CE4E4CF5D8569CE21881703DCA8D83A1C113FD5F440A4FC9E9B99A04AE8CF4490E17D62FFC09CFAC5A45678A4419EFDBB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............*... ...@....... ..............................J.....@..................................*..O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..|....................(......................................BSJB............v4.0.30319......l.......#~..|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k...........*...0.*...M.*.....*.....*.....*.....*.....*.....#.....*.....x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.EventBasedAsync.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21768
                                              Entropy (8bit):6.880530414500754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6067ECBAB3C6DDDB6BF7C49C7948CAA8
                                              SHA1:5F3DA777AF01DBC159BD8D9D97D5DC105918AFC5
                                              SHA-256:22108E32E0B6E42F5F52A4CB17B9B6FA3DFD547ECD9EEF9C67226DBEC54D23E5
                                              SHA-512:9F3E834B8342E0C7AA5CCC993B520D664B03F1F0091066C66067923E1D4991EFA03F63908552538C05F423AA2B696DE7C76993F71A7564F3E87662CB0FC00726
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$*......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21752
                                              Entropy (8bit):6.916008128976572
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2F39655CCFC010E32A7240D9BF5D0852
                                              SHA1:20AEAED12DFB8D71E39687350EB12BC0DE372AF0
                                              SHA-256:BFCD867F71C887429DFE008D7EC5D1853D15B3932D4CE8991694293477B5BE37
                                              SHA-512:9769E59279A32F29C2F2C6970C81D3ED76FE3421B819DDFFC8FA98329F1B45300C737FDF71956672F80F69B3A75727D184F8C421E00B84E94163A86CB744A991
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ...................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.TypeConverter.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22784
                                              Entropy (8bit):6.859096700065679
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D1699287934DA769FC31E07F80762511
                                              SHA1:BFE2384A92B385665689AD5A72F23ABC8C022D82
                                              SHA-256:0DBB92ECD5DFA7FC258BC6DEED4CECF1B37F895457FD06976496926ABDB317BB
                                              SHA-512:4FEF3E1535F546FFDDE0683F32A069BEEFFE89096524C7068F1F5CE8377824F82AE530D3990C9DD51BCCAA9E53FDED5613FA1174013325808059276DEE771187
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................:.....@................................../..O....@..p................?...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ComponentModel.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.910097922783346
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:632CC8AD69B76FD9BB5847DE1E1439F7
                                              SHA1:2E32D50EC33EC6635681485B754F4E58D434A5EE
                                              SHA-256:5E61D755616CB10524F5F31E9B70C65A7FFF8E30E25CE711AC8B354D657AB479
                                              SHA-512:9BA5CC82573308E5D995BA05BC660FC1C087EB91D8BD7EFCA6FF838A3C47BD6118D9C92919B2E0DAC11A5A27977318C5C819499DC19CD5D6E57122A0749858C6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`......|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Console.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21160
                                              Entropy (8bit):6.908265030965905
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA9376C17EE0148F0503028AD4501A92
                                              SHA1:9D5686CBF45E90DF5E11D87E7B90173A1A64B1A0
                                              SHA-256:B537313413F80105F143CC144FEEAE2AC93F44747727DE309A71D57D2650034A
                                              SHA-512:18D1BB2D5C469644078D75766DBF04ADDF7D0C543F7ED15FF522CEEAEF960900DD8EC68172F5D684B76B0AA6946BB38D641F021EC04C70AD66A6062C10412E0A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ...............................U....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.Common.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):154448
                                              Entropy (8bit):5.513799122521585
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D712A5A82A446086443CE00B610D8A5D
                                              SHA1:7ADD96BAA123DB819F2F3D5AA62D6F872CE8FE14
                                              SHA-256:1C7BFF6F16BB618648E699B723AEAFE511515CD6AAD699C25FAAE2A507E22811
                                              SHA-512:225128E58E2F01B5CAADA6FE54B1D32FF6A700542CE22B425649AB22DA2944F796F04D1A2428C542BCAB5348A161CF73F5F9A1E7BBF1F6417C4D507217FE3FD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................DR....@..................................,..O....@..................P?...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r;..p.(....*2ro..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rK..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rM..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Data.SQLite.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):402336
                                              Entropy (8bit):6.138265912892721
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:147328DEF2E79A86D7335A661EECC051
                                              SHA1:98FF30131D77CF28807D50B97CC92CC8655E235C
                                              SHA-256:7442D48A24C1747CB17D80E95C4D7343DE16E14A252484ACE3BE3FAE55B1D641
                                              SHA-512:D26F6627F09CAB90AE545DF68F2DF006F0BEB988CFADB16F6AF56A454E854A9B9C10D2CE787052B80536F9D05B7286D57E42F361F54944E20DF99B3C1C49AEFB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.........." ..0.................. ........... .......................@......Ez....`.....................................O.......p................I... ......|................................................ ............... ..H............text...D.... ...................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B........................H........7...#...........[..P...........................................:.(;.....}....*..{....*:.(;.....}....*..{....*...0...........~<...}.....r...p}........(.....(.....r)..p.(........(;.....~<...(=...,z.....sj...}.......}.......}............{............%......(>....%...C....%...!....%...%.........%....%.........s....(....*vra..p.(....,...}....*..}....*..{....*z.{....,......(>...o?...s@...z*.0..(........{....-..(......o....&....(V.....}.....*.................0..T........{..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Contracts.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.879068263314492
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99373AB10858746AAD424F28B48277F5
                                              SHA1:5042EE630A6C7C2986E8323A14D052C1D83B6F61
                                              SHA-256:9C4AE61E0E8365762EFE3D34C5595029F2C12E0079E6070720E2CEF0882C84E5
                                              SHA-512:E96F8FDD6FFB702D344746CE82DE576BBA8636EDE3E39A7DA18CCF8A0178B8346FD31140760B864F1487D7804D931FF1A18DE07A4CAFA0CF79BDB340421FC03F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ..............................mG....@.................................x*..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................*......H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Debug.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.940882019021464
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8B8C402311D7AB87E588675E736414FD
                                              SHA1:EB8C010A35B461402C1C33133F1B61C78BE8425A
                                              SHA-256:55A30D92D163CF1807BEA6DC13B4C13E70AEBBB034DC77EAEF4F4394730DCD8E
                                              SHA-512:D03F450A3A19320DE71145E48CD7C088D9B50D0A683CC9A79D8967DCE085A6F63CBE537FCA1C6208865EB52EAFB10189613C7233047318CAEB2FB2C23C34A269
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.FileVersionInfo.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21248
                                              Entropy (8bit):6.908174280383857
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0D9A641105098D642567B22101A4DE0B
                                              SHA1:12419C25D1C2EB706A4E4E649EE353CEDA7446A9
                                              SHA-256:7C25A74772E135257235640A0264DDC05235E14F3627896CFE735E9955155F83
                                              SHA-512:FD4560CDF01DE237DDF797A33C5DBC220D3FCAE07EDE17D43C39F5562E36E03646676A87E20699D7603FCA6D84F66C8756EB863DD4727B7E1A499619BB88DDE1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................@.....@.................................H(..O....@..p................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Process.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21728
                                              Entropy (8bit):6.856791185052111
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D86B0ACA05321569D9383DC7C4E9E934
                                              SHA1:2EF7D0A222C3A3E564B3C72D5B71A5BE40A7ADEA
                                              SHA-256:28B165CDDB82A2507114394AE398995EF8A50C549214F8678AA66054F6927754
                                              SHA-512:5959E1129C983825233A07869DD1B2B1DB32830D2B5F6B7F8D869C39A76A241F88F76D37341FDFBF56F000FC6ACBA19AEB36A7EFB94721494B41B65BF4978651
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............**... ...@....... ..............................vC....@..................................)..O....@..0................>...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................*......H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.StackTrace.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):23936
                                              Entropy (8bit):6.756576538241564
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA98A0F020248C2BE1DD40C07092F22A
                                              SHA1:EF6B3CCFF90BEDDAB5CE6F60B4CC23F75EDFD009
                                              SHA-256:CAE99F910874288AFBF810968D13B79D755CD4B2006609EC036EA4934181CBA5
                                              SHA-512:554A25C761102DC41A9E421621E329868D1162AB29F47E59754C8FCFAE0C12BBE8200E1B5975ABF926F1DE0977A5407C43202AC8A2801C69A7F01D95B6A1E959
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................?...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....*6.o.....(....*6.o..........**.o.......*.~....*.~....*.BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.|.....Z...1.Z.....$.....$.......3.D.......|...F.|...c.|.....|.....|.....|.....|.....|.....Z...I.|...}.Z.....Z.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TextWriterTraceListener.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21280
                                              Entropy (8bit):6.9260824081196715
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A964808487E671BB369DBC0E4DC5A947
                                              SHA1:C3848473E42E2F9B4D0A00180EA9ADE654432587
                                              SHA-256:63EAB38EE9F4DCD686C8E6A4F01E1E2A9BB91E52B20AB4DDE0C28061E9261860
                                              SHA-512:7352368B68835ECC9C5943AE2F2BD5CAB775A7FBB018AF7683E74FAD1731A9738AE14EBE0BCCD854A223AB762FCA7EC11411FDAE865C5C6DDD034900FA55CFD0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................G....@..................................(..O....@.................. ?...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tools.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.915565842835677
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:27C7D752C11C3F43F28EB31968E73E2B
                                              SHA1:51E466218025126C5E524AFD2086F4AB0BF3660A
                                              SHA-256:260C6250EF9B57DCA99B4CECC533F9A34857B5A32B5351202F776163841200AA
                                              SHA-512:393D1747911A7F91F4C4F4F363A3782F24E00431478088DA454823A223A4E75E51D9B010FC5D9746E2BF0185BE90071B6CB70C777337D718B39151EEF6B486AA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................C....@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.TraceSource.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.857834679374035
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37BE4CCE0ED037F8D9A7A3940BD2A2E1
                                              SHA1:96314EC1A59E4BB53C5B609BF79AD4C998A7A988
                                              SHA-256:C81A57D0634C462A6CF49844059E9B170F650CCDF0789519FFD4AE7D28E2718D
                                              SHA-512:CEDAC24F414CCE5053FDF10779DBD153FCEBAD69B3960F75A5AB1110DA18799C79DC01B30269641022FCD874A331BC2DC7CE1A7D1A60DC90E109DD55B58665DB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2*... ...@....... ....................................@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Diagnostics.Tracing.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):31608
                                              Entropy (8bit):6.6075135088084505
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:60F59659DB517C2F4DD4C5C583D43097
                                              SHA1:87ED79D195D8D93AE1155AF08857F751A7ECA245
                                              SHA-256:B84B93BE455CC7D14EC0C88CE08DAFAC7B6AAC2E549C969E7126EB48C31F8B1C
                                              SHA-512:90BCEA3BAA04146F08013A832633957C6D511D5EB52270575EF9A571153384B5A02C5026361B70940775907B5BC710B2C91627EEACE432744F3B9E5E1ED509D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<..x?..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8*...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o....*"..(....*....0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....*&...{....*.0..4.................}......+....{.....".......X.....{.....i2.*.0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Drawing.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.910934602645047
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:29B0A1554E54611EBBA7911049F26FD3
                                              SHA1:D707745E72D2F39374F2D28AF52AAAB7888B93AB
                                              SHA-256:2805A18724A24034AD6ACB315DAC516E479CECC5F3753204052657E560932D5D
                                              SHA-512:17558306A611BFAC6982D5650335B05EA407191290B653C028896142EBEE2ABCEB22F7D71926FBBCC3FAB8227C61A5FDA0E770ABFCA021AC7F891C9C7EE42E81
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................n....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Dynamic.Runtime.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.827241992748525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C5CADB1409F25B6A1C7A6DD4C2DF236B
                                              SHA1:A994C87352486D433A06943C01329DD721AB343F
                                              SHA-256:F600ACC811720183C639CEBE5618BAF9C8135B85B9CBDC0758BC9B2DCC6DD7A9
                                              SHA-512:6BD6E482533B9FF8FFF8823F84CDE7191A0FD5575F76891A95E99CD1F5C1122EF92B436745EC9583089445FD5EAC795181759080B1D83CCFA1EED31D9CCE3AF0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................`.....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Calendars.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21744
                                              Entropy (8bit):6.8850738754620915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AC2F4B435DDF0600D7A866F42F3B40D9
                                              SHA1:0564FF7F7E6084BD6D02D8E6A4127D1C878B3FA6
                                              SHA-256:B56FFB65B842DAAE13F3020B0B04646DB92F89801D2A2F89087D145A996D43F7
                                              SHA-512:DC3E9C3B4D732801DCF43CFD6CDD2672F01E03CB99D804A3F4803FDDB9CA9817BCFD2F96FD94B7B33DB0994F5478CE200C048DB5DBB78D3B24E950262EBF4D28
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............*... ...@....... ....................................@.................................X*..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.Extensions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25992
                                              Entropy (8bit):6.72175242984799
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7C93DE0627833900B8379FD181B7351
                                              SHA1:2CB98F9622F57A0A9E037A378519AA6A271302F6
                                              SHA-256:C7E91BD148ED22EE1FF8EBD3E58B199A30AF90AA37499BCF8DA34409672F2ED9
                                              SHA-512:1067BACC4495EACBC27937B54780B97DA62FED1AF66158E2FA492FC82B068D49BB49BC20C3C82C22D8EDD300BD7B097E14AA1E317F1789744E188BCA15D22B4D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................x....@.................................a6..O....@...............&...?...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o....*"..o....*..o....*"..o....*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*...0..K........-.r1..ps....z. ...@3.(....*. ....3.(....*. ...._,.(....rI..ps..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Globalization.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.947656997583423
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AE023BB0BEEE5189A07C7FD4E0CF3FCA
                                              SHA1:846711D4161A3950FACDEF97037898A71F4EFDA1
                                              SHA-256:56BD0C02C734ABF4D7FD1EF2E8B6A9E4BF5E4BAB4E606CD1023D63B02852FA61
                                              SHA-512:62305027AE8BB5B830630FE54F2CF9E607F9B97FFE28912C2CB15D429252668F17EAF2D7CEECF5601C889D5EA52E0B9100F115173BB11B5D6208171792833C85
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................PI....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.ZipFile.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.866908604521752
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BB1A520F25BB93ACE4DD0A060FBA677D
                                              SHA1:92BF07CCF32EB9FDF06F446A256E0271C4028BF0
                                              SHA-256:7720EE13405EA8A3C204703A181E67DC6D66835E9DF263C09D04D8B48B41EB26
                                              SHA-512:9288148EC879EBEAFD53C225854EE3BD3768BA5C7B829D6AF1251D20AC301FC27A04BEBB603FE2CDE6949BC5968FDE717E8B747337C1AD872450D26F7C36F515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................'.....@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Compression.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):110944
                                              Entropy (8bit):6.427912093819953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:33B8972FA6B00B8922210CA95E5745D1
                                              SHA1:609F31B98831327677E89E08BFF7D7322BA0F4A4
                                              SHA-256:DA18D61BB6B7D35C56CB4F392FAE0844CCA73F72A043A08994BECCB531FF3B77
                                              SHA-512:F85F03E20C8CE40BCF28D883CCD80CED755BF75D515FA66986963F0F4F5AD00BB1823D8C100A75323147B28A4916DD6C598102B18999AEB7B358C196AF4206DA
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ...................................@.................................5W..O....................r..`?...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r7..p.(....*2rs..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r=..p.(....*2r_..p.(....*2r...p.(....*2r...p.(....*2r...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.DriveInfo.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918416126337718
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FCB2158FC41D97E2BB71953664B99B9
                                              SHA1:16EB49AFCA84C9E6160B4E5B36F1EC5C98470C86
                                              SHA-256:984575C44CAB17D46587AF6CC8C22C409B79BEC280FD771E6AF93A0A0C20E5B0
                                              SHA-512:1527A426F8EC9931573468929966E102012B630EC4AA370C196B2B87472BCEE696B00355ADAEB39B4151B986470F7DADA415E3F930D9678B68D3C531C8AC9B52
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.918387036071988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:51B07204081BDE29A1F84A3B48554186
                                              SHA1:FCA2F72C039937357099CA6E167330E540F8335D
                                              SHA-256:5C84DD40D67C0E59906511D2B09DA8E28C454B5979EB5FDE74213F9D4BDBC564
                                              SHA-512:099EC1B84FCF6BF07142AD8CD34307C80F19A64C754ADE505AB55707075A764FBE7BFA4CE2FBAEAA09B3E61EBDB6E3D116608DF0CF77BC076C7B3119DB37A324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.Watcher.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.9502839815242545
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3772A3A7E55178EC90ECB607ABA28511
                                              SHA1:68C240D1A43DE1678EF13107B9300C544E9D5E4E
                                              SHA-256:C9E2562F1A1B86ACDB6957CF916ACED9C4F8B71EBB16DFA0050252146205AD37
                                              SHA-512:245F12B4926114EBDB39A54628A1DF2501C4A27ABD531172CC63BC96298EE0F4BE5658AE95FE730C063EADFB1B664C7D201C69C2246CFBA23ED5A4FE7EF3D14E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.FileSystem.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.922388458113732
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BFCEB4FACA75681137455CD70F8038B6
                                              SHA1:BFA0E27BE1D56BA48918A9B7CA7090AF7779A10E
                                              SHA-256:9A4595DBB128E2D8F373B3AC45478E7131F4D181B50EC821EC8CB88BD46BD5B8
                                              SHA-512:58D7E8D6FA237A6EAC018C0A88D6BF76AD9EE49B6A6790B64E68C33EBF80AFCB4223881AAC6821132B877E7D848BC917EB9490590CDB297F362C9B43143D6713
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ...................................@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.IsolatedStorage.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.911523435668273
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:AB8D293BCD7A13E83565B4AFA8438988
                                              SHA1:48F227C62B2001C441BCBC5B570911F096DDF421
                                              SHA-256:0E80A2E256D16E487BC847D1857ED7CD088F176254BA2A385D675338B836B0FC
                                              SHA-512:443DD75234C043DE736423466C1FC2FF2BD9B6B9FE753521C3C225DE99F5A7D3828A470CF8EA54678A86681949E5DCD1DE1EAB35BF0F348F758FA099A9092F54
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.MemoryMappedFiles.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.952503401221548
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:34E21101FAF71A27C6819CC051DEBC9D
                                              SHA1:D9DF77B4993418337894FF04C6B813224B9F8543
                                              SHA-256:81B6527AC2D18782AC24AE463C11DD1D70AB1BC89F626B7347A592229B371A1D
                                              SHA-512:AA339F2489CA9BC9EF7F6121C9586DBD8F5AD2CA5A160A3BCAC74B908570EC2FC0BC24E0EC33AE9DE9D6A6C3557EC2816FE8E89FFCA93E310503F6F83A691F6D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................!.....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]...................*.....*.....*...).*...1.*...9.*...A.*...I.*...Q.*...Y.*...a.*...i.*...q.*.......................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.Pipes.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.934271103866825
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:58A2E5AC0510B9223236B9317C505B58
                                              SHA1:A00954217CA326C54A863D451820263A6D7EE1AF
                                              SHA-256:80A229B2917FC3A5D941FF9745A6BE0065028AFDF9509300410D2721C71F1198
                                              SHA-512:18736ECFE0EF0C477BF64F89CA97AF4578DEFC996F0A5BAD33D7A29AF6E09745E4B10D6D543243B9664E40169EE550C996E783C5FFBB0FC767DA7FFC63E13FB6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................P.....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.UnmanagedMemoryStream.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.909892409390874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D74405753F829E75E89BBA5EBC296112
                                              SHA1:474944856DB781A34796BFCCE18ECD4580275AD1
                                              SHA-256:86F1F12E47F260985B08BB966598123578EB5E48BEF9BB086F04E16E9D53BB32
                                              SHA-512:CDC5D49FCF0249C539E45C9917C152F130C8FEE975D97C2F62526F474CB779B2BF273195F4AA7A64F76DD2496528C0D021B56E60AAE2635606F9F55092CB47F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1W....@.................................l(..O....@..P................>...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.IO.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21144
                                              Entropy (8bit):6.936275464847822
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:809FDBD7422A3E02C89244DC530A3367
                                              SHA1:A6999C04B243B034F8EE7AD0D79F3CE24DF9A9D0
                                              SHA-256:C191A43029EDD4EB8EEE003356F1FE79AA45071C25433A7A3589590E9089EED9
                                              SHA-512:5232B7EF2B60A99BE2B027112078A7DEBF58BFA4308F4AE53DD9A96FA7BCCBB0927BEB7148E7A3944173F7820F9F519767539D1FDFEF848B6F1D6668BE11FC15
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................A.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Expressions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.8873536206529895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B49BF361F3116DE28176B40845BC199
                                              SHA1:5627E53D15E56868DC9082EDCAE5A653B96B9AF1
                                              SHA-256:BF97F67165231C2A42B95F11D80337B082E2B2BE54351DA44C8A10C06194B369
                                              SHA-512:0FE87438ACD6C14401523987BE617A83DDFD2B42938FC52E0DA5F941F7DC70686CC6436EDD41C4998FD56D5F52D64ACFAB5010B96B1E80C084C4AB9F546202A8
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ....................................@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Parallel.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.913851684806603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8BE0CAA60074176FA1E7E63C0AEB6C01
                                              SHA1:4D4AE0D2664025327F28400D917CC59AFD69F33A
                                              SHA-256:30A49D16436E3A05569C99A0C2D21755C2FA323C5B925F9F21C10287CC97D9C9
                                              SHA-512:057F21A7E7496343C06CC497A24E46E59218EAE1838885EEEF7391285CDE243AFE853155F52933959B40F40AA7028A289D15D279833208BBA42BF853D4DF91C6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................S.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.Queryable.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.914858816124373
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E04CDB6229D83768285ACB08D870F23A
                                              SHA1:A181F5CC93E9273D9169A9954A74D73BC1852980
                                              SHA-256:719AC73BB261E0A13574F5A198126CCF40352264958DEFB555280D005134C704
                                              SHA-512:257FB07C0D86E292FE6FA88E03B29994CB9864C17A535CE7B366A728EAA4B3A803D88A23157CAA457D0B681A2C0D97DD7D9A2754300B73030D9A09C4E9004772
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................F....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Linq.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21152
                                              Entropy (8bit):6.8927140284137165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E33930FE2E0867CB1F9FABEDDFBD7B1
                                              SHA1:4D93C7D7E6315CA2195ED73716996ADE8E17FBB2
                                              SHA-256:349C7FBE9AE2B78C2F90239BDDFCEA5B16A0FAAC1FE83553A816C50C3E9089B1
                                              SHA-512:8F87B5013E0CF3A776BFB1F1A68F316A28AF3CB6C74F0ADF3EAD6D5063525C6668B42C077549F66267130959A9CB986BF5F8E4242FC4EF36C356D6927F587A0F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................~.....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Http.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):198472
                                              Entropy (8bit):6.150725701658664
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:665E355CBED5FE5F7BEBC3CB23E68649
                                              SHA1:1C2CEFAFBA48BA7AAAB746F660DEBD34F2F4B14C
                                              SHA-256:B5D20736F84F335EF4C918A5BA41C3A0D7189397C71B166CCC6C342427A94ECE
                                              SHA-512:5300D39365E84A67010AE4C282D7E05172563119AFB84DC1B0610217683C7D110803AEF02945034A939262F6A7ECF629B52C0E93C1CD63D52CA7A3B3E607BB7D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ............@.....................................O.......h...............H?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1...*.0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2*..J.Xo3.....J.Xo3...(...... ........J.XT.*...J...XT.o3...*..o2....Y./..*..o3....%3 ...Xo3......Xo3...(.... .......*.*..0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._..*....0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NameResolution.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.9009750652396775
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2EEC710DBAACD32BEDFCA09ECA8DE52D
                                              SHA1:2CB934305D3648FF29FDBC7D92485003F8458848
                                              SHA-256:222BD77C5692C2961E8C3638F6511D6F7CBEB9E0977E2D5C3BCA6739A5311F37
                                              SHA-512:03F132E1BAC629A394A093D59550B22D5FD4C4D6F244697173229282741A9CD6669C4256C024467CE94293C74F304560066711C35620AB4750621502AA67B5B1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................f.....@.................................T(..O....@.. ................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.NetworkInformation.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22248
                                              Entropy (8bit):6.861480146265617
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F39A35095CFD0019D6D4BB8461750BF0
                                              SHA1:AD55AF22E5479A5ADDF01D698138E5149270E3CF
                                              SHA-256:2E2D28A0802D8C8C08C0D422F48733AD8BF1DFAE75F5682A4A3DF8898E7E819F
                                              SHA-512:25FC9D4254DE0AFAB9AE3E19B8B225E1D875DCACE6CA2C83F768B62C0E2B331CC9DD2988DFF7994B5819FB0DD7A89A49FD19E653FC2E4EE656182E08A969A93D
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Ping.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21168
                                              Entropy (8bit):6.898664332146086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2A459C2C395F54352A16DE4AA0E5407F
                                              SHA1:1BA9ECC598E170D779CEB290163AC88E6993935F
                                              SHA-256:4D97E8481B9A27042BB903245625735D82FF627C66797DE619303C1E705D0D6A
                                              SHA-512:28DCB8B6E306015D2004EC00443652CE986AB8E09FB09EB82193BFB0604268CA63C527FF64B6364F63C3ADBCDAF5FCDF4D1494243BFC8F6BB629BD213073BD7C
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................|.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22216
                                              Entropy (8bit):6.840714789582829
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:562F67001889CDBC2531947636418EE5
                                              SHA1:B219DD45550762B54DAB46533D489C4755F55E0E
                                              SHA-256:9A8BA725F8E953C933285065228A9409036F9137D03016B127CCEA8A19452466
                                              SHA-512:FDE868018D24FD72177EDE58952325B52561F9D44AE02A4A2268E445F47ABF3B81B809F443D362DF83BD6667B5988AC2CA15242B9F76A0B5FB5B444FADA1BF26
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................0c....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l.......#~..|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Requests.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21184
                                              Entropy (8bit):6.933179959460408
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28141960A88365DF6A60B0C6FF831B0B
                                              SHA1:B56C3D2E270B1C793A2EE17CAC9C98B178258E94
                                              SHA-256:F2E74A3EC2DC753C9A48FA9A677775F949EB1E02FC1BB8BF38C39E8D2AB147EB
                                              SHA-512:CD44E789A6C04E2BC3B07810B57CC83787F06530065FDCE069D89E42557F40770923CC705E73B7699731166F19FD7133FBDD8EDD578D308A4F72CBB29E76939F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................d.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Security.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.870719034523618
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8D00682E84D1D773D2160B63C0380BA6
                                              SHA1:5E4158533532A27E03D0CCC9A0AF5E89FFFD8637
                                              SHA-256:D0D90152136A0ACF340FB345098F2E5C718BB13F3B5A809D7BE4D9948B8574D4
                                              SHA-512:991FC952B452446255963AEB4F11C74E7116E15B666924452F3C0D15517322EF1D925DC44BC1F003E8483B5C0B34AD71D54ECAEE360FD9E942664FDEC4E37E99
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~*... ...@....... ..............................X~....@.................................,*..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.Sockets.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):30544
                                              Entropy (8bit):6.684598614993447
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9D9F45B85526E491F6555B1566A41C
                                              SHA1:1420EF91F6E0F6954F373F1AC4079064398AB455
                                              SHA-256:694F4C61B6BAE0AEFAC07A1E861C12C03CB6002F30091E4C8B05BB9C8CCF0D3D
                                              SHA-512:38890886C641D7E6E76A3D4D984215C680F5DCF12129BA2EBD560644EDA793335B01C637C1F6744C249DAB1FEFD5AEB8D1B212475221C03DF3CA82413F6670C0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..*...........I... ...`....... ...............................[....@.................................gI..O....`...............8..P?...........H............................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o....*...0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+*..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+*.0..L.......(....~....%-.&~..........s....%.....~....%-.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebHeaderCollection.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.910950453979084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7DA1FEE108A0750F47B70F25FE2CC55A
                                              SHA1:6523838EF4AAB39D0D3C0DF11C28ADA449EDD592
                                              SHA-256:69B48FF8E6F40B84CDDDB95BCDBB34E1184A2E29CB4CCC0FC9F1A2493648EE37
                                              SHA-512:9C0E69C07B2ED6CAA9BB3FFD9EBA6C82A0B763F2DFB06341F6343C54DBC254505CC0350B96B79DC4062D8D28D47C79824E98BB293C8C85203E827164AF862B5A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.Client.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.91070814532456
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E06BAE626965FBDB0BAE5437498B5155
                                              SHA1:49392F58BE6F5C97C5DE59BFC44F9CFCBE1E5DD7
                                              SHA-256:19766A20B62B038ABC3E863F2D6E7B55FABEE4D9CBCAD3EB1D7BD3EBFE8D023A
                                              SHA-512:69C6D8D5F8835DA31D36940F0AE793BD00D87E9CB9380C3A7B21FE3E315F192F95B8E63C8F9D0A3737C73673A0AEAC41FC728FB7B236F12453A953066F9E53E7
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................|(..O....@..@................>...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Net.WebSockets.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21192
                                              Entropy (8bit):6.92602478259668
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2E6378FEAEEE2F745417FC025C7850F9
                                              SHA1:E0FAD5EF75676B2ED7CF155AF6602B867FCED041
                                              SHA-256:99920CE34A01A0C07EFD86D6E134BB401993515D001B7567A4116AD222993A63
                                              SHA-512:5A8C41F32598BCF8C8E315B18AD5F1BBC377D7B638DC05CAA3CC47E988536AA0EBE4718D73AEE39ED5004328BE3A9DE9722D8759E5DFD500038E7139DADF9638
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ObjectModel.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.907185647363724
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:55D9528D161567A19DBB71244B3AE3CE
                                              SHA1:8A2FB74CF11719708774FC378D8B5BFCC541C986
                                              SHA-256:870EE1141CB61ABFCE44507E39BFDD734F2335E34D89ECFFFB13838195A6B936
                                              SHA-512:5338B067297B8CB157C5389D79D0440A6492841C85794EA15B805B5F71CFED445EFA9099C95E5BDEF8CF3902A6B10F032BFC356B0598DDE4F89FA5B349737907
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................L....@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Extensions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21224
                                              Entropy (8bit):6.911906528800318
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DEFAADD4A92D4D348B0827AB8159D2FE
                                              SHA1:F3BD9B4108ACD42ABFB99A3A4760BFFCB84F6C28
                                              SHA-256:3D2551D6458B84566025FDDFE5DAD479CAB5785428EFD6814860D36AD1811C9A
                                              SHA-512:1B13C70F05D56871008D5C8752BC93C8FB590D5F89B4E97264F592CDFD772CBBCCE8380D255F8BB305BC25BCDDEA21E422617FA614DFFD3DDCC9A1D4BE6C54A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21736
                                              Entropy (8bit):6.863412750707488
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF318475E6A7A56789ABB0F98C37ABE1
                                              SHA1:33D1EBD7212D747C8723CFB9E4292C99A641B964
                                              SHA-256:0383DC02FDF0B5D4612D8CAAAD13D594CAC1609C8240B73DFD6EA5803F5E17EA
                                              SHA-512:5C67456A65FD051147281E14041F5165C1852FD6519DFC8DFCF9C86F20217CDAD9E2D26F815B557B99E2DB3500AF47B2DF8A1225A659FA1069815CD62302458F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N*... ...@....... ....................................@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0*......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Reflection.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22200
                                              Entropy (8bit):6.818690002285853
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A3DA139180E9FAB380033D8D1FE3995
                                              SHA1:3CA31DE7F0F0784559E5A73EBD0EFB42C34D18FC
                                              SHA-256:63AAF632EE7F3BC852C4D71C742CF1D26F18F784F6C89113E056B2599BA8F514
                                              SHA-512:D991298419FB5290D6906A1F9FCCEF56BB3E17506E235C85B4D979EBC49ABD4F4B3123697E675346B57829C3EFDEED6291A155D69348CD55B8B6B2EEC9F804A1
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................Z4....@................................. ,..O....@...................>...`.......*............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h*......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Reader.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897645601910542
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F1CC91D25B52C7504DC5BEAB5D0F498C
                                              SHA1:498F0FBBD2712F4F637BDB7370B2302FCC4966F3
                                              SHA-256:E3036362506D96C9C00ED6393A2AFCACD9F2E71CD2A35C1D638A61E85D2FB040
                                              SHA-512:4C931389035DF21AE67810D8C8E95CB613D9495E2392B11E34D84F624F90C78C541B14FB0D6FE7F0F89799AAD4B34E91FB6F73978AE38231840F047915E6EB5B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................q....@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.ResourceManager.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.926543977764199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9E71DFCE86F14BEEB8F3E9F00D0A472E
                                              SHA1:BF83A7E98418BDE907DEAE8C0C0F3FB0F6C9DB1A
                                              SHA-256:62DCE4679E33C079E11F41B096BC803B30B1D963A1EA79EFA84187CEBBC06AFE
                                              SHA-512:FF8CDC0287E510F859F46C1E35F9B0FB42EAD907B1EAA42C90C84B31CF6C2D4638CF682777F359B8611DD22062C1A5FA71F7FB667B7A3903783673E678098515
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Resources.Writer.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.904224159979604
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05D1B950C470EA8B0AA357F9A59CF264
                                              SHA1:B1756DC750ED5CFD5D0BFC70CB899FD590867A0C
                                              SHA-256:DAAABD07F1B94BE19D72913360286E469F454886850AFCC603506EAAB03150E4
                                              SHA-512:8E65FF1909AC8D65F599062E61AC935A919D43404C357DBC6AD628923B0C7ED7158862DDD272CFC1C2A8CEC393D48A57BC4D69CE7706EEF1BB6838826B1AFAE3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.Unsafe.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):18024
                                              Entropy (8bit):6.343772893394079
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C610E828B54001574D86DD2ED730E392
                                              SHA1:180A7BAAFBC820A838BBACA434032D9D33CCEEBE
                                              SHA-256:37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
                                              SHA-512:441610D2B9F841D25494D7C82222D07E1D443B0DA07F0CF735C25EC82F6CCE99A3F3236872AEC38CC4DF779E615D22469666066CCEFED7FE75982EEFADA46396
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."..h$...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v*...#.;.-.h.......0..#.....a5|T%W...].!.%'..9.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.CompilerServices.VisualC.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.872325269765102
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9F31B6954FD453F13B5F39DA36F2E8EB
                                              SHA1:7A6276348D85EAF00AE6958117797045929078CB
                                              SHA-256:18A610B8BAD43CF784CDE4D4902A238F2281C2A677DAAE790CAB55F6DA915979
                                              SHA-512:D3696D4D60CFC5AA5834F60A0B97A4F3A3F8EC3FB05BEB3C3D927426B72B3E5463C628C7DF950E43FF1344823B8C2D39730BA47BA0F2FEC7A0CFCDC237A5BCC6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j*... ...@....... ...............................R....@..................................*..O....@...................?...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Extensions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21720
                                              Entropy (8bit):6.851248273705748
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B0346A4C5FA0FAC135509A0E7D3C4449
                                              SHA1:7D71B46BB9A28289384AA1EDF5CB03D64B3BCFF0
                                              SHA-256:F9FEB277F86241F55425182A26DECF50A210675D4F040EC542AF3FB3DD287DE6
                                              SHA-512:916A465236F11FF6E421800961B20CB80A320176DA8C58002F6742040CE33C5207D378667A584C5D8E35CF8CFC19AC54504B3F6129E489EEABD86A5B4E7D8C77
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............*... ...@....... ...............................Y....@..................................)..O....@.. ................>...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................|.....|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Handles.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.924980445039345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65FBBA7A86B3E175200AE44727AB40E5
                                              SHA1:584B8683943A8E0AE98B10F452C94F6109D1C4EA
                                              SHA-256:7A81D2A001B543B2A55C9AFFC845A5DF7EDAB1FD308C6979BBD982B1B826B57C
                                              SHA-512:43607AEBBB0A3F2D437C7DE77785CD6C9F49411E1D4EFE41ECCD93D7FCCA197DABD4E15F45FBC4FBFF27C202FEC96B79F82202AFC88B59C20ED5E7912BCDC6D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...............................d....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..................................................*.....*...c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.RuntimeInformation.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):28624
                                              Entropy (8bit):6.700175270481286
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:568B53398BFC0E54AAF448B68F5C77C2
                                              SHA1:76B0B6E65E38A90A4ECDB3F6DFE16D5A803081E9
                                              SHA-256:8BB9D52BA5C67F05C8F632DEB1E7E98A909318B10E1388B47E919515FDD42CBF
                                              SHA-512:6052EE3664FD2095DE3338CF6D24DF022DC13D00B4BF14C57572F2A34AC078E07BD1F634A50028DB0952AE8067FFCF19079177FA534240D9526F33AE1E1459AC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ...............................V....@.................................PE..O....`..x............0...?...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r/..p.(....*......(....*2(.....(....*^~....-.(.........~....*.0..........~..........(.........(....-Y..(!....{/......5..,

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.InteropServices.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24296
                                              Entropy (8bit):6.780229572480669
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7E74EA95786A02687CE43C356ABDC95
                                              SHA1:2E6A3047BD3BCEE01F55D139A3C03E6D4D2DB14A
                                              SHA-256:383A1F9DAC655C6805C24D4A03BC5FBEB9ABD1536DE5510F5756259EEFCB4871
                                              SHA-512:B7E76B65406904F092FE96DED558A94EA53FA40BEC500EFCDCDEBF124921F4526DE2F239CD25BAE1801692DD6DFE5652FFD46B2AA4325133C7127D27F626BB9B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................k....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Numerics.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.898006718463938
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6CCCA0BA6A7B9CAF8B8D3B0287DBED8B
                                              SHA1:B81FF87B407578EFBF184BDC10D0F101610379DB
                                              SHA-256:16E7EFD6C19B2E3E516AE1BC7B3175D0E22F1AD357701F229E353DA348EEE182
                                              SHA-512:8505479031A0A5CAEEEE1A8A60AA35D7E0C332BBFDDE61193B615E242C127780E55F404289F26930E9EC9E53FCCF436B1A991BA2C8A9177163B41AAAF6BE0D32
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Formatters.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21264
                                              Entropy (8bit):6.950539566613158
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A42C32F4E98A9656FC2FED72D30E9380
                                              SHA1:B6B8986FC1B5140817DE262AE4102499E37DAFFD
                                              SHA-256:C343F7BF08A4C97A90BA607A492C721533333173FA63F65F6E5DE9CEEE65FC16
                                              SHA-512:5C2DE8F18CB9B367D7DE88A2AF8A7FD538486B9FFB393972FBDFF42CD2899D6679FD8D7076FE37954D5E8EAB6C5041F19EDAD32659C5CCEEC1C2BA35E6F8982A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................|)..O....@...................?...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Json.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.93694523950017
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E2239979B853157BA75310FEA7E65D
                                              SHA1:EE1AE416570911282ABDD3745674E58F9D469C9E
                                              SHA-256:E8D531F0AAA674F794B7F43EC76E4E32AD93F3C136020CF4B6E3433832F9C0DF
                                              SHA-512:DDF9D6E05D9566C9E02295A061756FF164C408EA211D016023EDBFA91BBA4D0D7DFF293D2BF4D87C25FE923500C7535E4A21B6A8D4B18FD9505F8E5C635F9C95
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................#....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):27048
                                              Entropy (8bit):6.661112158879877
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3373A24450373CAF0CBB756E10097FD4
                                              SHA1:87C352153804FF5BD4F8AEF8851546F3CF22461E
                                              SHA-256:575E26A455892F1FD77B730E6928F70B760E76094AFE5BCB677D854DAF869AC5
                                              SHA-512:85E005B5BEB7C14BA34C62C38DA635962D1AA4740F91549B8659910EDD10F0FDE1734064B19567BF5BC63DBBBB62399F6CBE0AA323193DA599232DCE22B14A01
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................Ag....@..................................8..O....@..8............*...?...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......|!..l............1..p...X7......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.Serialization.Xml.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):24816
                                              Entropy (8bit):6.774158289322937
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9087373EEE85190DAF8915E614B1E4BD
                                              SHA1:F434AF8CE30EAF5511E28C0230211F0D8ED4A154
                                              SHA-256:557858E44A51A74646AD07A85CBA56AF1DA13AD26AC2F74EE5D8C3E8A171C221
                                              SHA-512:F728238FA567457D7977FEA667FCCB56C2EFE718A9A362E294934CC752E506E05C5D20C0BE2A309DE2A984DD60C3AE4EA03054185B96C9B5F5F5DE827AF9CEAF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................6~....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s....*..s....*..0...........o....u......,..o....*.*.0..%........s..........(....r...p.$o......o....*:.(......}....*..{....*.(....z.(....z6.{.....o....*:.{......o....*.(....z:.{......o....*.(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Runtime.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):29360
                                              Entropy (8bit):6.504362287456874
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0E35085C130D2D91E5241334BE7EF0DA
                                              SHA1:FD622ADE5CAE26353A22B6FA50A83669B72B6C41
                                              SHA-256:50AD612D4CF6113DE26B2870DA099C4817F59E64A2DA98F05803B4A2E2304919
                                              SHA-512:2498811F4AAC308CDC55C3406BEA4FEF5DC9E6F23559B09FB181F7447474EF586F00038282DDC39C241490B5DC2BCA7F41F19BD3E1BB00890DA29DF6489BB151
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..*.........."H... ...`....... ..............................7.....@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8...*.8.....8.....8.....8.....8.....8.........*.8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Claims.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.921540746927502
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:99604779C668D9B8EF913854B9A24F9D
                                              SHA1:97B62A3DBE2465B4C995E082AD6FF183F6267F59
                                              SHA-256:8270D1248950EE8AEE5C2AC2E321DF07E65C7A94004AE03C857DEACD231A5542
                                              SHA-512:BE6DEE6E7030B400EAC68AC289EC9B74BFE0140EE59AF5E68BF43A63A821C6F6AD9CA03C501896A6C92464BF8116D7996FFE640AB51BD9FA96673D9794AC82CD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Algorithms.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):47016
                                              Entropy (8bit):6.126380612996906
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E4A1681E09AEC6EFB00FB2A9355A1296
                                              SHA1:95699D187BF150D319CC64F90064301CAC57F338
                                              SHA-256:967DDDBFE7F1CEB933B5875D65C59CDB835BB063F287A361E8B35DD814A9B14D
                                              SHA-512:49299C773A4C7CCC235C54A91FD07A000CF547B3EE55272E2EE8B2AA40281DC0AF3C3B5A9EDF5CAEE4BEB3AD0DE5A0DEA07159ACEBA582911B78A6B85DB793B0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ..............................I.....@.................................u...O.......8............x...?........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rI..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r9..p.(....*2rm..p.(....*2r...p.(....*2r...p.(....*2r=..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Csp.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21240
                                              Entropy (8bit):6.935501042478791
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F554762FC38F81CB22D1DC8AB5CD40D5
                                              SHA1:A67FDACEB10E828805A9E24FE0C59E1D73D19A7C
                                              SHA-256:566775F5502C3C1FA70ACADE145293DF5D02C1A9F031820D429605E9B4584B44
                                              SHA-512:BD23571BF9D0FE62BBF5FDDCAFF6B8F383CCC728AFBCEEBCAD8404D68C02EA1F55D4A22306BFC86C30172E70C6CF5425F2FF8877AAA8758A51C48CF4303BD2AB
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Encoding.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21256
                                              Entropy (8bit):6.945812678642078
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7AB10B31C5CE290672B319D403751E95
                                              SHA1:ED23E654968B3704A82F613B06BE5829E0CAAD70
                                              SHA-256:1F5C1ABE1B2720680170388569354D8CDA9D558B53AFF7CAF175CE0F7E3733E5
                                              SHA-512:65ED3AFF2424E7560FCC44380DC719BF200D444F9B06AF7F916D52152C330D55A7F4B96D0C1D2B291B07D82805C71DD9850F2F5F612F00ADFCA1CDF117C6B14A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.Primitives.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21784
                                              Entropy (8bit):6.863777213641518
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A60084F9988C7907F7092C143C8D3818
                                              SHA1:A69238054BEE26063D32B85B797BC4E0C49F79D4
                                              SHA-256:B755D0B55A465D07C9DD3FC11822487D1E649B684AEF91A4CE9B935B416A01B9
                                              SHA-512:6147F18BD9C49727251CBEA7A3168E3B19F34056DE5A9898571ECDEC85D424627A72968072449C81F97F95330BAED7E2ED0F6FDBA7E2F79B59B9352AB11003CF
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."*... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Cryptography.X509Certificates.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22832
                                              Entropy (8bit):6.823696761227228
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:06D000552ED6785988AE188FC35D1B86
                                              SHA1:B0A8868D459FE0AF34D16C263CFE0202C414DC53
                                              SHA-256:3C8630ACB43C12A6A317227FF2922056ECD991FE945464FDF7EA81F1293A479F
                                              SHA-512:F3E5E97AAF3D26EA62C64787198CCE6DF703EA3A4EBB389BEBC84B424C8129A0181142A4FA5D965CA3106758A047D0E1A723F181AD293FD389C4F1B8D290B5A5
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................j.....@..................................-..O....@..................0?...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......|...#Strings....x.......#US.|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.Principal.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21208
                                              Entropy (8bit):6.913262967781329
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6DCD91B6A029794728F4EDEB2BF2E42D
                                              SHA1:82BA1313448B431893C14D866F46D47B620514A9
                                              SHA-256:02416BC542BE82002B8B81ADBBBCDCC8D098104020D09B571DC674B5BC19A177
                                              SHA-512:2566F369EDEE9313E823AA2667CB95977F0DB57B4B47DA62F44850811F524D0598FDE6F5BB082BB3325789E4B256E970603B4297D3586F1C435498430723A38B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................s....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Security.SecureString.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22392
                                              Entropy (8bit):6.85070945929809
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4523F60270149BAD67F6AE63375D2CDB
                                              SHA1:FF6E6BCD83A11D40BF53DABD0480A67AECFDCF50
                                              SHA-256:18032D190D0D599823E59C8DD8B588909BEF8888B8BF304723A138B61F1B911F
                                              SHA-512:025E33F6927E634FE187491F40D96B36B2DDAF2ACDE97B340C8705BAE58BDED6C02B8BF9199A1B9D4AC75884C69DC665DC03B34571B1BD178CA1784C5F0D5451
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................#.....@.................................>)..O....@..................x?...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(....*..(....*..(....*..(....*BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.Extensions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.925439366434707
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D40515A84448B91315F956E6D1A6C64B
                                              SHA1:7FE773332D0461A252E52BE720A7794FCAAC7BFB
                                              SHA-256:CBE29672CD2B6A0EA97B55F3844FBEDE3E591996F39C3AA1F829F2FA50551FA9
                                              SHA-512:322F82AEB9EB9DA22257AC9FE835BF1C54C1BB268D37F0F97A4CA52BB42F6ACCCA9C8DBDB96D6D695FA69C24F5069978A4B6F1E960EE81D9EA671CCD30A348D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................iR....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.Encoding.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.85763123423511
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7F65CCBF58C39F3853BB8DC4137DFD12
                                              SHA1:3946DFF0B68F0CA01689BD44C348559ADF548258
                                              SHA-256:0AB1F7F87B7C2AFCA57D394E4F4E262C82BA3209CB0A750CD66401FB33F21ECA
                                              SHA-512:FF7D953EC4B82C10E64FC85D3AFC8A1A58582170EF1752D4688FA1D48EFC490DBA5F0A784E748F7902E96FD885EA868B1A84DE44F48CF071975F3CD3F8E52C6A
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2*... ...@....... ..............................'.....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Text.RegularExpressions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.952743264834991
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7D317D88F9860A18ECF7FB90B33995D3
                                              SHA1:C2E4B19CB9A0B48E899512CD121FFE6657D41072
                                              SHA-256:C98A52BD017DF01AEA7B955E6F219537D391A62C2C2B976684DA282F9CD7CACF
                                              SHA-512:79ED01C6D1CEA3DBA6B3566E03D05A971745E221BE9330F6800A249D1B239E092D3FF704E7403E7ECD6B7709B24B0CDD7E518F2EE5DA38019E7139D80594173E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................Y....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Overlapped.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):37752
                                              Entropy (8bit):6.646566139863202
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A890C488CF2ECD406B804E7E3C5B7F0
                                              SHA1:BF2C1287F0EC04223CD17FE20AB2ECFFF18579E3
                                              SHA-256:F17FF442B77A6CFE9C118D2F8FAE1AB6C814A0D4F35C5844996BE84F3FCC8592
                                              SHA-512:4EEC61F9245DFF3D468818D6D6CBB8E12A5172658F1027A9AB0ECE03CC1377499833056A0DD4FF20B83B9FF9E47BB2E7F8DC7B641BC63AD78FF96C54BE01F524
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T..x?...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rK..p.(....*2ry..p.(....*2r...p.(....*2r...p.(....*2rc..p.(....*......(....*..0..;........|....(......./......(....o....s

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Extensions.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):25984
                                              Entropy (8bit):6.291520154015514
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                              SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                              SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                              SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.Parallel.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21232
                                              Entropy (8bit):6.924199325151996
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9088029E38B2A393F22AFD9E576CE86E
                                              SHA1:05E65EE95F647F38C717C73A0399870912DD374A
                                              SHA-256:3468E0C875DB94A8F45D56AB76BBCC677B942CA51A23649BA3C5AD1B20E391F1
                                              SHA-512:23DCF5819996EE0F0C8FE044D6642A12E98A40309CE1F3F74688CF8E3DD6F6ED230AEC391FE7E511E15FBBBF14BFF09F976E923F22F2D68AD816D8FFAD17F101
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................d.....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Tasks.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22224
                                              Entropy (8bit):6.854915516686979
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0AD301EE2B7282B87DCD0D862EFE14DC
                                              SHA1:F720109A38846E358BDE7C47D9C946A79D2B6B1C
                                              SHA-256:0110616DFE870B8BCF25DF8F6CE38EF5AAC39E728DDAA3420EA199F5A7E80A16
                                              SHA-512:C66FC92435C399804D8A8C1C836E5648725DDA8A55D7ACD897AE719CA231D89251A0D9A293A67F079E345709CFDA83DCC693AD41A28D13661A55459F94FE33E0
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................k.....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Thread.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.917303618941186
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FDB3A743B2DAE5924CBA88A5C865128D
                                              SHA1:C53132EC95A7211C1BB6DCD5AD21CCB150A7B923
                                              SHA-256:9D4FAEA9892D4ECFABF61986687FC6CB30F5F51A6B62819B9571FF58E04C4DD5
                                              SHA-512:CBD8370F3CB84CB9EB8BF3A7392245D6A90CE1A324971EA96170974DA092BDFC3DB2196F66958CA5D5000F13B18AFAB44FF82D50C5B9A625AA1B7A4AF17717DE
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.ThreadPool.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21216
                                              Entropy (8bit):6.913880291057063
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:18CE4ECC42FC8D999EF091D812472CF0
                                              SHA1:F874903CEA9F08F1A0887949B47722E6BA81B789
                                              SHA-256:3D9EBC81B1BD3234666C8CE403A5F17A726867C68FFA5DE4EC8EE92599335658
                                              SHA-512:0C027440EF6F6C105B0BF9319F4E0EA421FD310699028AF0A159300145C662E74B4B5D969663E3B52CDA7F9934A6AB93BBAE9BCD1BD39AAAC24FCBA7EC451156
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................L.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.Timer.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21200
                                              Entropy (8bit):6.897588144752097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:824053272B268C577E9ADF17ED398142
                                              SHA1:5EA3F290ECDE1BAB983CEEE2417A688B7ED9B7F5
                                              SHA-256:04B9235F64C9C846F8A767230714895DA87C7AE2CD0105E9D14835AE46F0FED8
                                              SHA-512:F475DCD2CC23FDFB017688713170FCAF8FEA05869A680613EA4AD84CB358ED0F2442DB0FF0DCBD739E3CC3DB7128A8F4A568AE8E5AF6A8840319B02630E420B9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Threading.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22192
                                              Entropy (8bit):6.821272653310105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:11D674CFC81B7102C0BC6FFE58F6AC5E
                                              SHA1:DDDA49572D112944EC9AB62B31959AA93A386618
                                              SHA-256:4DC8D588EC63641C28422D648E8DE5E2C030EB7AFEC2071A99DD3BD9A204557F
                                              SHA-512:FB7C628B796A321AD9ECBF01D165E24F151C99D7E60A65D0AF52F779AD60A3203F47B247D44FC47044A68790D1EA4EE458A7BC8DF7EBE9D42C2275A9C11BC324
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................).....@..................................+..O....@...................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................*......................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.ValueTuple.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):78992
                                              Entropy (8bit):6.056589052139225
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8C9424E37A28DB7D70E7D52F0DF33CF8
                                              SHA1:81CD1ACB53D493C54C8D56F379D790A901A355AC
                                              SHA-256:E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
                                              SHA-512:CB6364C136F9D07191CF89EA2D3B89E08DB0CD5911BF835C32AE81E4D51E0789DDC92D47E80B7FF7E24985890ED29A00B0A391834B43CF11DB303CD980D834F4
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................>...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........*f..o...........o.........*...o...........o...........o.........*...o...........o ..........o!...........o"........*...o#..........o$..........o%...........o&...........o'........*....0..L.........o(..........o)..........o*...........o+...........o,...........o-........*.0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... ...*....0..k.........o5....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.ReaderWriter.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.911176710124494
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:090FF56C4FE2EEFF2E16F03099AD71E1
                                              SHA1:EF317CACC230A58A3B2FCC6CC079CC763AFCC7C5
                                              SHA-256:5F560E1DD529BB2529D7052E04008449F58D0439C2BB43437D7B5D39F84F949F
                                              SHA-512:FDAC43D0A18D9158DB4438349A7A550557A36E6ED0665EFCB65A046A5BEB5C38181996CBF6D860B8AD01C19E35315BB61AE766CAF06B23985E046484DAB45256
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................W.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XDocument.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21696
                                              Entropy (8bit):6.875690583921479
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37E21B63959F243A157534133F85C5AF
                                              SHA1:DFAD52A9990B2FAFCE7098CEBB174927E8E0BA00
                                              SHA-256:4F6A14E4BA2A2B26B8B8433D5F82F75A96AF5A4F036D9447373B07271493917B
                                              SHA-512:F59FAA6319FE2AFEBCCBD643E20C1EDB75DB74E9271354BD86DAC3BEA2CC59452EE024DC26B517AE88254A7C90DBE0E6C19A7B5AB3BFE9159D986D6C53CA5521
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............*... ...@....... ..............................#F....@.................................|*..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.XDocument.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):22904
                                              Entropy (8bit):6.8552351968066105
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A5F541655A9EDC24F4B5184A40E40227
                                              SHA1:90E196DCD76168F770ABE30098399BC5866ADF1B
                                              SHA-256:B33D08149A756A401628D11BFDDFEEACA1F03C0578395BB061DAE44F8A12CE5D
                                              SHA-512:C4D13E95114E232300B36ED7B7A72CE786F66D0F68B0ED9D54FEF788A831B39C893DAA3C2DE982B376A56A539C23E8F314CE8552ED7094E6826D5F70BFBE2D4B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ...............................+....@.................................z+..O....@..x...............x?...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P*........................................s....*:.(......}....*2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XPath.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21176
                                              Entropy (8bit):6.950543834803339
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:415E3AB72F17F10D646B3E2C7A76F612
                                              SHA1:ED25E94D4E88293345A0F28A5B975159C393B050
                                              SHA-256:24DAA1FAEE0478BA58FEBE8EE789EB88BE0A14D350B57AD8B10690C55976B2E1
                                              SHA-512:55B5C22B87F21DF89D0514AE05C9433B65A3C7532845FDFC4C2C5C5E2C3929D70143D84698FDB4DC13EC01895B1022CF0E5E76E12102739530B54150932A7B07
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................x.....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlDocument.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.8884260737638385
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:328D12AF9613B0F3F25320B85DCCCBF4
                                              SHA1:09D02B85A094E925AC3C5D8B1ACA096B730C160F
                                              SHA-256:8957F0BCEA6AB8A011A53AE62466505199F11A228F87F3809931D974F87078CE
                                              SHA-512:16569ECB727ADA36811E72FFC925F07AA21B8A627BE45F1EDA18CF2B759939591DCAFCB2D087596EE903C5ABFFAF19F56F25E9710EF22874C934CAD19537B798
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............*... ...@....... ..............................\.....@..................................*..O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\System.Xml.XmlSerializer.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):21712
                                              Entropy (8bit):6.916807633540711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D9F02D9F7DA653F82E75112A2AB99CE6
                                              SHA1:BBBB4C2C3911AE1F5BA7FAF1D632ED0F14D9B6AC
                                              SHA-256:21493F7F615A099E795F7FAE7ECCE6082414D1D427790BDF4B103623A3AB34EB
                                              SHA-512:DE5546FF103CCC6AA38E254039A372697A193F9C44D0A44F0BE3B242D9EEF63023DC3FD0C6E8E0D2363177F9230A4E7200D4C32591B398269A1CEE9BC47A99FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfAppBar.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):15872
                                              Entropy (8bit):5.392167003572151
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:65A2CDAA1A7B477269B24B128C6E7CEA
                                              SHA1:3A154ED01006332F3A7A80DC45A323C7DEE10E48
                                              SHA-256:9B7D806282ABD8EFF2CAC6B12E097E57603AB0EDE82ED5752F2B01B17FBA6B07
                                              SHA-512:781D12BE7CD13FA90E9C685957782420F5D64B092B9115CC7E019AC670DAE12BF14421AA8F4DFB08D04E0A818A25C0091AC47CAC60DBB3EAFBA2D168C67E398B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.e.........." ..0..6..........^U... ...`....... ....................................`..................................U..O....`..x............................S............................................... ............... ..H............text...d5... ...6.................. ..`.rsrc...x....`.......8..............@..@.reloc...............<..............@..B................@U......H........+..((...........................................................0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..........r...p.....(.........(.................s....s....(.........r...p.....(.........(............s....s....(.........r#..p.....(.........(....#......i@............s...........s....s....(.........rK..p.0...(.........(......0...s....(.........~.........(......0...s....o....~.........(....#..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\WpfScreenHelper.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):17920
                                              Entropy (8bit):5.2867272535707315
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:24A725F929CEA66D043FA85A39228B67
                                              SHA1:2B874371B1705DB4434FCBFCA03F8AF57B36F2B5
                                              SHA-256:6E4B9D12FFA3AB66D6B913974F44A969031781FB82BB0921391A00C4D18F85AE
                                              SHA-512:654459CE76374C70017D51D1A1894D369EA9427B7700A91889C0989627056816926DB8F60B971DC4DE3BCDFC8BC09BA9E3615BDC1C9B8AE0BC495A47DF17B28E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0..<...........Z... ...`....... ....................................@..................................Y..O....`...............................X..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B.................Y......H........1..P'............................................................{....*..{....*..{....*..{....*..(......}......}......}.......}....*....0..q........u........d.,_(.....{.....{....o....,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o ...*.*.*....0..b....... F.5k )UU.Z(.....{....o!...X )UU.Z(.....{....o"...X )UU.Z(.....{....o#...X )UU.Z(.....{....o$...X*...0...........r...p......%..{.......%q.........-.&.+.......o%....%..{.......%q.........-.&.+.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\app_profile.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1091
                                              Entropy (8bit):5.422867818033837
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B7C72A299A37A2C1DFBA450EA4DA1C0
                                              SHA1:E1470C1F3DFA59BE0284703594116475FECC04F5
                                              SHA-256:BB9E8767511EE15BC7F10DEC46C127B486D3BBE4794298D7E259CE30F79EF790
                                              SHA-512:8B7AE4F307FD3D644F9364137C7358DFF156580B9483C67191E78627FF8CCAF27C6829D385D38647F853CC6E2CD6615887E4361B8A4299CF216848D899724E84
                                              Malicious:false
                                              Preview:{.. "ThankYouPageUrl": "https://clearbar.app/rd2/?id=195104Ly9hcmNhZGV0YWIuY29t&guid={guid}&ext.id={profile.BrandName}&ext.version={app.version}",.. "FirstRunUrl": "https://clearbar.app/rd2/?id=382844Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "ContentLinkUrl": "https://clearbar.app/rd2/?id=175902Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "UnInstallUrl": "https://clearbar.app/rd2/?id=273811Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "SearchUrl": "https://search.clearbar.app/crx/search.php?guid={guid}&q={searchTerms}",.. "HomePageUrl": "https://search.clearbar.app/crx/search.php?guid={guid}",.. "SuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}&output=json",.. "ChromiumSuggestionUrl": "https://meta.clearbar.app/sug/?s={searchTerms}",.. "BrandName": "ERS_ClearBar",.. "FeatureUrls": {.. "weather": "https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203061_{user.InstallTime|format_mmddyy}",.. "app-icon": "https://search.yahoo.com?fr=tightropetb&type=11745",.. "maps": "http

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\css\app.29e34c24.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\favicon.ico

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\arrow-left.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\arrow-right.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\back-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\back.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\breakfast.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\camera-light.14f45916.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\camera.cc7b8dcf.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\chicken.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\clipboard-light.1026c11e.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\clipboard.c4755019.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\close-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\close.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\dinner.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\ers-generic-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\files-light.675f9318.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\files.2205c6a9.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\google.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\healthy.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\apps-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\background-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\background.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\bookmark-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\bookmark.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\calculator-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\calculator.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\compress-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\compress-win11-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\compress-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\compress.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\doctopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\doctopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\doctopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\doctopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\exceltopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\exceltopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\exceltopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\exceltopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\file-explorer-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\file-explorer.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\home-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\incognito-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\jpgtopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\jpgtopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\jpgtopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\jpgtopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\linkout-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\linkout.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\menu-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\merge-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\merge-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\merge.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\mp10-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\mp10.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\newtab-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\newtab.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\notepad-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\notepad.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftodoc-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftodoc-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftodoc-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftodoc.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoexcel-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoexcel-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoexcel-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoexcel.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoppt-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoppt-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoppt-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\pdftoppt.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\ppttopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\ppttopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\ppttopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\ppttopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\print-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\recycle-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\recycle.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\search-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\search.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\snipping-tool-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\snipping-tool.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\speedtest-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\speedtest.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\splashed-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\icon\splashed.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\easyrecipesearch-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\easyrecipesearch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\frompdftodoc.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\manualslibrary.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\mapsrch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\myofficex.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\logo\tvsearch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\lunch.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\mic-light.ef89f88c.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\mic.0bbff27e.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\more-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\more-light.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\more.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\more.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\pork.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\search.ea2d187a.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\steak.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\vegetarian.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\img\warning_1.20159b81.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\index.html

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\js\app.3f57d9f7.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\js\app.3f57d9f7.js.map

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\js\chunk-vendors.f61cf75b.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\appdrawer\js\chunk-vendors.f61cf75b.js.map

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\css\app.29e34c24.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                              Category:dropped
                                              Size (bytes):68594
                                              Entropy (8bit):5.953541522446685
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:98745E5177402EF0F176EDD61CCBA811
                                              SHA1:266CD639017D2E62D1113F141C9A63B469E7D9A0
                                              SHA-256:5382E992A85B5FB9369704DDAACBBBD2E6068D0BF1A854EC54DF96D8329459DE
                                              SHA-512:0E99F835AE77AD1A1D4889F8779FDE126B6D23B0FB0881A39B61D7E813D0D57AB8C03AF91003091DC2BD3E91AD0AA894F336C440FF2178066225D32C58EC9853
                                              Malicious:false
                                              Preview:html{-ms-transform-origin:0 0}body,html{padding:0;margin:0;overflow:hidden;-webkit-user-select:none;-moz-user-select:none;user-select:none;-ms-user-select:none}img{-ms-user-drag:none;user-drag:none}button{cursor:pointer;border:0 solid transparent;background:transparent;margin:0 0;padding:0 0}select{-webkit-appearance:none;-moz-appearance:none;appearance:none;outline:0;box-shadow:none;border:0!important;background-image:none}select::-ms-expand{display:none}.appForm{margin-top:25px}.appForm label{font-size:11pt;margin-bottom:10px;display:block}.appForm .submit{width:100%;color:#fff;background-color:#2e83e8;border:0;border-radius:4px;padding:10px;font-size:16px}.appForm .sumbit:hover{background-color:#1c63b6}input[type=text]{padding:10px;width:100%;font-size:16px;vertical-align:middle;margin:0!important;border:0 solid transparent;background-color:transparent}input[type=text]:active,input[type=text]:focus{outline-width:0}#easyRecipeSearch .appTile img{width:100%;padding:0 0 10px 0}#appScro

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\de\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.557060180794725
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F83D720B236576C7D1F9F55D3BB988F9
                                              SHA1:105A4993E92646B5DBB50518187ABE07CA473276
                                              SHA-256:6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
                                              SHA-512:FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\es\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.425694157692337
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:15DB634B70D6D9D6CD41BAAE3F02EB14
                                              SHA1:1456FFE09DF896271A746F9CB40A230F188AD397
                                              SHA-256:E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
                                              SHA-512:1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\favicon.ico

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                              Category:dropped
                                              Size (bytes):4286
                                              Entropy (8bit):3.4289655345950862
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BA2AE710D927F13D483FD5D1E548C9B
                                              SHA1:C0605EFED936EE2600284E6480521D06FA64F872
                                              SHA-256:DB74AB0B78338C1F778F8398C45F4103C99AEA0E845A3118A7750B4EEAFD3445
                                              SHA-512:F933CD352EABA92F509B3863353DDFEFADFADA26A4152ECDC4727D450BBF35E7B10FB3038FE8DB340D5C63D74E608C1560EC84D0F6FFC8CCD940C9E0D7533544
                                              Malicious:false
                                              Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................................A...A...A...A...............................................................................................................A...A...A3..A3..A...A...........................................................................................................A...A...A...A...A...A.......................................................................................................A...A...AZ..A...A...AZ..A...A...................................................................................................A...A...A..A...A...A..A...A...............................................................................................A...A...Az..A...A...A...A...Az..A...A.......................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\fr\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.588569516197988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3B4621370ADDCF4306669C9E7E45C865
                                              SHA1:EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
                                              SHA-256:E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
                                              SHA-512:586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\arrow-left.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1206
                                              Entropy (8bit):7.429541001775313
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3FF3DD2B2EB2A515A16FA6C4F2815168
                                              SHA1:E6387B9CA6FD579614D6B3126FCB54E3CF0ECAC0
                                              SHA-256:497D60C8DB29A194EA5447D41227B5E84A5277DB00343608135E9E76DBA2EA8B
                                              SHA-512:EB51045CC5568AF0908B04AA6567EF051783B7CCCC9554937DB63FE8505035AA27E70BD073AFD53B996D3CD1D7659D33611D0165BF44D2CB39789D79547B3A63
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<...XIDATx...?NTQ...A6.;..D*.........X.....-.3..mh..!.*4..+.w........~'9y//p.y.9...%........6..z.C/r!r..|.y.yq~z<...x.m7r+r..?>..D....A,..M.>&..A`..9.*<k..i."...)..C....GM.ysc..9.b.i.d...:..8.-..........qr..T.X....f.....q.[......b'?b........J!.#.@..($.QH.b.H...%..#.#..O.....%.....C.#!s#....sY...@...X^....5'./_.... ..A...($..zH.b.$.j!i.UB....."V.IF....X.d..x.Z..5!b!kCDB.......Y3"..vD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E....F.3..CF5..CO..Ck ....+r_....,p...."7Ed@......G.(.T1...y...mY.....O'bN.y.~.9...M.G.......vye....-..f..k.m(...;o[.G+.1..T..V.......[+39dl..6dC.\q..W..kyog.....\_..@......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL.d.(.1q..b"!k..B.......Y.f..5`V.I....Y.$..JH"f..4.!I..CR0..`......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\arrow-right.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 114 x 197, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1262
                                              Entropy (8bit):7.450317933347086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4938252838021C4B8D3FE8D7071A3455
                                              SHA1:A74AA59A582C48E682F66FE733723BC101DF7A51
                                              SHA-256:FE96C1EACC80CBC4CB5EFF18C879F36517E24BD74A934A4E61781F7ED98876DA
                                              SHA-512:F7F066ABED7F336BA3861F60E6BCE1122DCC6B9016F7D39BDE22F05BC24F74224A58ABD98C757A3BED7C27AB626514000F675622462169EF31FDA843D0DA3B4B
                                              Malicious:false
                                              Preview:.PNG........IHDR...r.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...N.A..q..8;. .....ggl.+Kll.'0<.....F...x.......,....]..\.......d2..7...3...-,..xt..x..}7.n..z.a..(.('.~.8.....vT..lDi.....n.^.....@.`........9....-.....,.$.....j.......d.x..=.6.........BV...4.v:b.....?.L......;.3X.T...5.y...w.}...=.6..:3..V..a.ffM..q.ffM..sh_.. .s.5]~.)..B.95....S3...}C1......g..WV......]...;{..y....r.v..p.a.43'..H.N...b..W7...4.....RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A......)&.RL... H1A.b. ..A....,...Y*&..DL,di.h.0.`..Y.f1.t. ..AR1..$b..I.,...Y<$.SH....L!!.BB0..`.J6>.o..../.,5.{.;.[..#3.......t.X..#.j...f~.....B..3....m.H...ddfWH.f[H..........jKH...C!.GL..:2..a..O...S.8G.bO...w.:H...".....#....t.fd...]%!I.BB... ..A...($..xH.b.$.b!i.EB....."..IF,...X.d..x.R..%!b!KCDB....,...Y2"..tD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.@......)".RD....H...". E.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\back-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):535
                                              Entropy (8bit):7.291049020073603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3D007B58BA5848E00F8696B18B556BED
                                              SHA1:29AE472529C3A55FB1C0AAB0ED75881F99A61603
                                              SHA-256:FE84519A946DF413EC68690FEFD01D5947F02BB2DF702E25A310C439B96037BE
                                              SHA-512:8C98412ECC4220E655DBC983F66A6DC3631D404377A3587DA29BDA1126B7B850254FFC6FF8036227F44631BB1A794738059FBE412BC8F8D5656DA26EAFCF0723
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...1N.@..P......!.|.*.TT.\.. QPQq.N`Q n@..>!2.%#E..Ivv...H#+...8.......J..*...........7....{.u.u....!.3........l.?..:.@h.....j.K...o.........C...Y}........g..C.u..nJ.....^..!...Kx........'.`....5|........E.,.....^..R.....G...>.......D....}4..'....Q.}. ...[.jd.....fY.../..L@.P.L..N.V....ZD.~!d.A.R.........a...."..I......."$..gDH>1..25..69..:=...@B..b..&.."......D8G......I^.X$I.0...~..9`.B.......$........8..8...\?...Vr/lL..I....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\back.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1327
                                              Entropy (8bit):6.795559024958409
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37CB8F3A11E945F71A957D7FFA8A1182
                                              SHA1:B83FB5495341889D1F2E7CDD117C94FE258A068E
                                              SHA-256:3564C06E511B461226C7C9ECF2168FC6F139FAAD65F3B02965B014FE602A7722
                                              SHA-512:3202B1EFA77F25A4FCB2811D2B68C65BAB4142BF38A97E5DD9DD68A5617347B5B3BF0236BC975A2F8588288A9F87CD82F66806C692797F63E94E8E69821090D6
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD90411F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD90421F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903F1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD90401F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:..r....IDATx...j.A....V.v)E0...X....RX.....b.|.K.{.\f..5.?0.....|. ...<..j.&.<u(|........|6./.D.X...D..@.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\breakfast.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):17332
                                              Entropy (8bit):7.952338772479115
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:28674DF1583334EE8F43F5C80D593967
                                              SHA1:13346EBA24F0060DCBF049F1FA2DF668637AE224
                                              SHA-256:1D58F66B9FCFCFCA7CD0EB1F7428B4A4F089262C76E96FBCE7F608130E556218
                                              SHA-512:E36FF01435412228F25FEEB1D3DA35AF0C8E4E0A62455622014E48B30004826E86C5A755EDA63C5FCDE0A33E66C6A1E414FA26CA48FFBC675A4989E4BE61A130
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856193C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856183C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\camera-light.14f45916.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):983
                                              Entropy (8bit):4.412861219299836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14F45916CDFC158B3471660DBD356511
                                              SHA1:D77E332C3C47BD6B856058EEF623770067290AE4
                                              SHA-256:17333C84677CFFD3A86E60BB329AE8DD31600403FA5AF67F86E9BEDEC3346F9F
                                              SHA-512:715D4674F16131B5F14405A447FC4821343D20A701CE168A424FDA62BB45C157D8A3B261806475C0A201F74B4206E002DFCE6E40494C63E3057406119C6635F5
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-df0b36bc-87ff-4225-9ffe-f9b44e142dca" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.53,217.64c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V67.5c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.53s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V74.95c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.54Zm198.32,117.79V78.25l-49.1,15.78v62.04l49.1,15.95Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\camera.cc7b8dcf.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):996
                                              Entropy (8bit):4.415354176387463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CC7B8DCFB7FE59A7BC76935D5296C692
                                              SHA1:34EBDD9634960C621730A00638145B993C228453
                                              SHA-256:F9CD3C47CC90E0E89B0DDF1AC9558CDBA170554CDA335F12A3C315011650968D
                                              SHA-512:4C7E5FA84C5ACACD3F07A016C02B599A736E3A57C3B92FE0203F7589A953FE738CD4DC803303555AE33C51E3300136C189C2190395F78CCDD50F589A00345D3C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-e946cf5c-d3c2-4910-8d82-f6979d21310d" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256"><path d="M35.15,220.45c-9.24-.01-17.94-3.61-24.49-10.12-6.55-6.51-10.2-15.19-10.27-24.42V70.31c0-9.29,3.62-18.02,10.19-24.58,6.56-6.57,15.29-10.18,24.58-10.18h114.46c9.29,0,18.02,3.62,24.58,10.18,5.98,5.97,9.31,19.69,10.03,28.74l56.77-18.58c1.09-.36,2.22-.54,3.37-.54,2.3,0,4.5,.71,6.36,2.06,2.75,2.02,4.43,5.26,4.49,8.66v123.88c-.07,3.45-1.76,6.67-4.51,8.64-1.77,1.33-4.03,2.08-6.32,2.08-1.22-.02-2.33-.2-3.43-.58l-56.92-18.62c-.72,9.05-4.06,22.79-10.04,28.77-6.56,6.56-15.29,10.18-24.56,10.19H35.16s0,0,0,0Zm.01-163.41c-3.48,0-6.75,1.36-9.21,3.82-2.46,2.46-3.82,5.73-3.82,9.21v115.62c0,3.48,1.36,6.75,3.82,9.22,2.46,2.46,5.73,3.81,9.21,3.81h114.27c3.46,0,6.71-1.34,9.16-3.76,1.73-1.71,3.81-11.62,3.87-16.8V77.75c0-5.16-2.05-15.12-3.82-16.9-2.46-2.46-5.73-3.82-9.21-3.82H35.17Zm198.32,117.79V81.06l-49.1,15.78v62.04l49.1,15.95Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\chicken.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):23700
                                              Entropy (8bit):7.964027161033084
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1BC1121BEF4EBB12E422BB6BADB35B99
                                              SHA1:0652990C7FB223C12D256694DCE483D6B8F3DAF2
                                              SHA-256:1432CF23FECA98D653FAB1AB5FF0307CEA3E441CB7DADE775518581481CAB7F3
                                              SHA-512:87F6787B5CE55841CF5554635CD89FF56339652EF154AC6B1504B38883C05A14E22704810AB08C01F8EE9A73D55404C77EF23431733EAE5AFDD9310C70373EE9
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F8C3B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8B3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\clipboard-light.1026c11e.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):2221
                                              Entropy (8bit):4.2786994579900615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1026C11E10BDC6019F4190CE4233D981
                                              SHA1:3BFC101A08D51701E7D1112120B92E59690D1DC2
                                              SHA-256:E815A1B6748800EF156B9F19B439E39DAE5E789A11A338629199C7642BB412F3
                                              SHA-512:41AE6CEB10499135D729A22CBDC7723B957AC45C3172BBFC7C8C71312248CFA56BD17ACA6DE53A1189360C5BB3A25DEEB4ABAFDC7CB58725717B21D78BCCFC27
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-77845bb5-a874-4e27-b437-95053cfc2dcb" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 186.26 256"><path d="M16.54,253.44c-8.36,0-14.91-6.55-14.91-14.91V48.02c0-8.36,6.55-14.91,14.91-14.91H49.52v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V238.54c0,8.36-6.55,14.91-14.91,14.91H16.54Zm0-205.96c-.42,0-.54,.12-.54,.54V238.53c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V48.53c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H61.34c-6.8,0-12.33-5.53-12.33-12.33v-5.69H16.54Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z"/><path d="M169.98,35.66h-32.95s0-2.58,0-2.58c0-5.66-4.63-10.3-10.81-10.3V14.55c0-5.66-4.63-10.3-10.3-10.3h-43.25c-5.66,0-10.3,4.63-10.3,10.3l-.52,7.72c-5.66,0-10.3,4.63-10.3,10.3v2.57s-35.01,0-35

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\clipboard.c4755019.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1573
                                              Entropy (8bit):4.491393830823473
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C47550196B668814E613B509A3824F75
                                              SHA1:4F4DB715519DC926A773A8BD9900E05AF9A950A8
                                              SHA-256:1C35DF90B296640C59DC75EF78B3BBBA823E33EAD4FDE1A7F03D0721AD89AB6F
                                              SHA-512:55E035F0C7611CC0A93984357EBDDDE931E8FE78A57EE951350E9D15A10C10B8EE0C8E39F3F184F2436EF55D030E297CEA61F4DD623BDC9A9729DABFD0627F17
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-227f9840-cadf-4a76-a544-8951bab65ade" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 189.53 256"><path d="M18.91,255.72c-8.36,0-14.91-6.55-14.91-14.91V50.3c0-8.36,6.55-14.91,14.91-14.91H51.89v-.54c0-6.15,4.52-11.26,10.42-12.18l.39-5.91c.04-6.77,5.55-12.26,12.33-12.26h43.25c6.8,0,12.33,5.53,12.33,12.33v6.35c6.2,.91,10.81,5.93,10.81,12.18v.54s30.92,0,30.92,0c7.8,0,14.39,6.59,14.39,14.39V240.82c0,8.36-6.55,14.91-14.91,14.91H18.91Zm0-205.96c-.42,0-.54,.12-.54,.54V240.82c0,.42,.12,.54,.54,.54,0,0,152.94,0,152.95,0V50.82c0-.42-.12-.54-.54-.54h-30.92v5.18c0,6.8-5.53,12.33-12.33,12.33H63.71c-6.8,0-12.33-5.53-12.33-12.33v-5.69H18.91Zm107.64,3.66v-16.68c-6.2-.91-10.81-5.93-10.81-12.18v-5.69h-38.67v6.21c0,6.14-4.51,11.24-10.39,12.18l-.83,16.17h60.71Z" fill="#fff"/><path d="M145.58,107.97H45.69c-3.09,0-5.15,2.06-5.15,5.15s2.06,5.15,5.15,5.15h99.38c3.09,0,5.15-2.06,5.15-5.15,0-3.09-2.06-5.15-4.63-5.15h0Z" fill="#fff"/><path d="M145.58,140.41H45.6

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\close-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):689
                                              Entropy (8bit):7.470888262014754
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B2A4D8BFE3DDA8235572C5291CF5EC16
                                              SHA1:B55934F745A5E8C5F89571A6D6E8AD5974C39529
                                              SHA-256:474CBA015A0D6B9D888435008783C68E256D68464E5F48D434DFA60C18546386
                                              SHA-512:B84BCC4119704F582C5454554FA73597B9D4506908584E7B102D161A363363B8DA5FA5C7C239C858E596C2E8AA1A12E8B9233F1E2B58094DF1E56F5C1BF4741A
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...SIDATx..;j.@.@.!e ..%.K.2...B...p.s....Hi\.\.E..WFd."8.......*....fW..n..s.j..(...q.....f.[<,1.....*............?..6.'............'x.bL1v.s...!.....o...W....?-.(..z..f&....[.........f2....e..X..,J..?g.:I....E.......i........B.$..~.. ..>.QXS..|.Z@C.'|.bHR.7|.jPB.....0..)........Y."9%H.g......$6D..|V...4.Jb....W-x6..../.........* B..<..D....Z..q........S.......Oh..}....d....}w......xq....jK.E...]..........fP.?rW.D..Y.iJ.mxm.`.^S.X.....5$.5xi.`.^R.X......%$.uxn.p....Z.$.v.v...-.'^.'.V9W.,..Gf."u........#$.#^.m0._.`j.C.y..)y....}.&... !.}...FF....o."..(...1.o.....+{b .j....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\close.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1345
                                              Entropy (8bit):6.8231056736743
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF21377E5297BCBA7FD195E8204C6A1
                                              SHA1:A464F0152C77310C8D0502AEACC1EA595D45029C
                                              SHA-256:D99B459F58402E993E411E4A98DE037C23A618F87D810AA32A1A1E0855775B20
                                              SHA-512:A565AF098234A1072F33E0D39931BE3F6448FC697C8AE35731BD3917F0E1215FF89C1D17A50A186609CE63847CC46BCA8DD05C0ADF5292C55FAC90108EE0A16F
                                              Malicious:false
                                              Preview:.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:24DD903D1F6811EB8B83BB2A7388F281" xmpMM:DocumentID="xmp.did:24DD903E1F6811EB8B83BB2A7388F281"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24DD903B1F6811EB8B83BB2A7388F281" stRef:documentID="xmp.did:24DD903C1F6811EB8B83BB2A7388F281"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]5....IDATx...m.0.Ec...:h..St...m.D.=......[.0.@..d.O.'...CLI....e...........B.1{t.'r.A..<...1.'..W.$x....G..Q.\

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\dinner.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24301
                                              Entropy (8bit):7.967633053853199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:441510E2CD58585F9EBA9A67C151349B
                                              SHA1:F830876AB69D0AE9BAE2C825E55F2FFD1338114C
                                              SHA-256:89297F794EA9E67A9537772A7F9BF92F4454B4B5AFC7CD99DC29A67D6501BB31
                                              SHA-512:121F07D1C31189136E7813CD4CB88DB6F97354AD2F14CF73DECD429D46E4819255CA0DF9BFA06DE64E60E918B8172F429096BEB9716639C61856027AAF62CB90
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC6856213C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC6856203C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\ers-generic-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 299 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8821
                                              Entropy (8bit):7.941167788075973
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5D96C4B6C1B28F921D03B5E351066B32
                                              SHA1:AAE53E5F6DBA64421874B44011454311507AE5F9
                                              SHA-256:BF6C83BB24DCFBE8A786CB761B44D880DA056862E5D3A673C79F0FF87C7DA4B3
                                              SHA-512:B2C0CF27F7A5BC52F6E84CF8E04A6CFE0A754C1A0DB1748445E81505EFEF4D034D305DEEF9C920D58C22FF36C53FDF0840E059C7400F0DEA474630496D1715E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...+...,.............tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..o.UE..O7.2.h#..h.W.JvQ......KF.Y.@3.d.&dL&.f..DGe.,n.+d.L.qm>.+&.i>..........gWd.[.........{..u....{..z...%7....:u..o..V..B.!..B.!..B.!..B.!..B.!...i........._jS|..`...-B."...+...'...M..w.............8B........S..;rE.^{.D..+I."...D.f%J6..k.....5..(V./q.7.S= a*"`.\.R...X............8..k...a...T#N.M....s......T..8..+bW.jc...s]..]....1wP...8.pQ.8..D.7....J.pmg..bE.... T.A.b.....Y.A...E.M......k..R)V....S.rRtQ~2.B.~...*.P.A..pB...k.CD.U."UW..E*\ T.)Z.+.E.N.......Y)O..A.P...E.N.N.b%U.j.sR..E..,R.J..8.d.....C..K..SB.....CJ.....UU"UO.<...Id3.Dk.CA.*3.Hq........!...!.ahH..J.j.M.9..D.%..Y\5.X.M.....utY.+.)B.E..J.z...t.).!....bu.Hq..H...m...U.T....uSD&....aa..G.TH...P.......Jg......+.a...G\...W..]X..X.B....}.g.J.:......O=.yN...jEL..Q$.S.z.BE....AU.Hg..H.,..M.fs.....+%T/%L..8....(V....=I.....R..X).z)....$.W.(XA.....p.+...P...`.!V.*B..,..BEH...XQ...G...+..!q...bE."$>..no ...m.bi/

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\files-light.675f9318.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1905
                                              Entropy (8bit):4.228743440669764
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:675F9318839BC2ED9844F0362D4FFA51
                                              SHA1:B9C2D6CC51C60466496146B2A5CCB45692EBE752
                                              SHA-256:9DE71B0E8AC193DA8BA883583349E3D7195FC3C00ACA69522FB6B4231EE8862E
                                              SHA-512:8319B958935EEAA64EECC0BD87A867632B4CD9739FF4D68E5E9EAB67DE67B846FF1E8DAF0FEDEF60D50E0C6DA086B9A0E6B56F0C305DF07970D7DC64D5F46D72
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-ef6ea559-e414-433b-9daa-5a8efc02d046" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 239.65 256"><path d="M63.14,235.36c0,9.63,7.83,17.47,17.47,17.47H220.41c9.63,0,17.47-7.84,17.47-17.47V66.41c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S65.22,119.97,65.22,119.97c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM223.91,66.41V235.36c0,1.93-1.57,3.5-3.5,3.5H80.61c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V62.91h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM87.15,117.95l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z"/><path d="M92.4,162.95c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,6.99-6.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\files.2205c6a9.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1954
                                              Entropy (8bit):4.314503847869972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2205C6A95F92E5F1A0FC56A03ED82C0F
                                              SHA1:5FFE38827DC4C88C5335BA4FCD927424E8015667
                                              SHA-256:37E805FEF2FE023E8B8A7AD29312AA8302080DEC8F0C36BACDD1834FA9FCB44C
                                              SHA-512:084E69CE9DAB8DCD5863E40DD54522931407A439C06214BD6042C6201C4886EB01B58A736E2E77F7E8009E238A71998FF7324E48333BFFBFAF803C1838495931
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-a90c3c08-9176-4501-adc6-bfbdd6819c26" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240.74 256"><path d="M64.51,235.9c0,9.63,7.83,17.47,17.47,17.47H221.79c9.63,0,17.47-7.84,17.47-17.47V66.95c0-9.63-7.84-17.47-17.47-17.47h-80.38c-.12,0-.24,.03-.35,.03-.34,.01-.67,.03-.99,.1-.21,.04-.42,.12-.63,.18-.22,.07-.46,.12-.68,.21-.23,.09-.44,.22-.66,.34-.18,.1-.37,.18-.55,.3-.29,.19-.55,.42-.8,.65-.08,.07-.18,.12-.26,.2l-.02,.02h0S66.6,120.51,66.6,120.51c0,0,0,0,0,.01-.33,.32-.62,.68-.88,1.06-.1,.16-.18,.34-.27,.51-.13,.23-.27,.45-.37,.7-.11,.26-.17,.52-.25,.79-.05,.17-.12,.34-.16,.51-.09,.45-.13,.91-.13,1.37,0,0,0,.01,0,.02v110.41h0ZM225.29,66.95V235.9c0,1.93-1.57,3.5-3.5,3.5H81.99c-1.93,0-3.5-1.57-3.5-3.5v-103.42h52.42c9.63,0,17.47-7.84,17.47-17.47V63.46h73.4c1.93,0,3.5,1.57,3.5,3.5h0ZM88.53,118.5l45.89-45.31v41.81c0,1.93-1.57,3.5-3.5,3.5h-42.39s0,0,0,0Z" fill="#fff"/><path d="M93.78,163.5c0,3.86,3.13,6.99,6.99,6.99h102.23c3.86,0,6.99-3.13,

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\google.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 40 x 41, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1634
                                              Entropy (8bit):7.837252352889036
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DB657DEE7B23B0FCD37F8480A728AFBF
                                              SHA1:E6D261A2BB300D3FAA50038C9225050C5CE6C10D
                                              SHA-256:E3C03432E4B767C370C4B1F4102FA3A41C20A43CE41770876CADB22ACD6E1CD9
                                              SHA-512:9AAC1ED52A9C777814A0A1A05AF7E29EE8304F195179247652A16B529737A53378C405205BE5C26B402228DEE42B6A4BDBCF193572CF9B929DDB1B04B58ADA9C
                                              Malicious:false
                                              Preview:.PNG........IHDR...(...).....G.k.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X}LSW.?...Z. ...K.B...1*ch&.\..?3t......fK..q.6...8...d....@..H...iA.u.h......>vn..Hi_..'9.w.=...{........([2.f..B.t5e.u7.........F.`Wzb2...s.,.%.bp..Dd.%9d....P..\.W.p.....Ql....T"+........Qn...X...-i..c.t..j.....Y.V....(C...>...q".e2qJ.(x...w.6nAlM../.wS....S.:.D..]W...9>.m.......7..#...X..#....n0v{.....X..b..L.\...)L74}]k....?.0-D...q.0~..:d....l.8.8/:.g.4.^.u.....U.br.\>Q..J..o.|vnMS....6..J.O<m......:...X;%..... ;Je........."|#1.Tn.x...V.1.|j\....<....Q.$9..E..P.z..,.a....o....tg.}.....DDRY.,.-E.6.N.....!...0..P. .s.Bp..?.v.p..\m0..t.'.#..L.:.........y&.{.>...%7.{....?..WP.FC...{......A.._X..V4.f..n6.s.>/....6*\.Y......[~#.@K}...9...!...V.w.........ZOH.0v.>.i..:..+.:t@.....A..r..R&..8...mq.F{odG..N..@@W.D.....|..........._....._.I....dR..5.@.H.F_.....wl....@.7...k...x.,eBZ.$....M.g.X.e..)9.....x..;..,....#..<..b.%...+%$i]*.`...c}...w...WQd..<...0......!

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\healthy.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):183341
                                              Entropy (8bit):7.9824348413333945
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D7A0970290EBAB6ADEADB69473D79C25
                                              SHA1:F047731E1243F45F08B14716CB6B37B2DAED0709
                                              SHA-256:192208B45833B8730E41B28173A07308FC547D60F5F2944670DD1074AA24119B
                                              SHA-512:784C895C9A594405CB29965B9F785D2C53775F5CD71780CFFC86523137CF0DBB655581B86A559EC75473892DAAD3582E2909501910C10EE162FF6570C9BDEC46
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......d......Adobe.d.................................................................................................................................................*.....................................................................................................!..1"..AQ2#34.ab5.qBRc$6..Cd%..DT7...Sse&..E'..Uu.8........................!..1A..Qa".q2....B#...3.....Rbr$..C4S...c...D%5sT.&6.............?..@.......@6..&;..+*.....B..F4d...B:..z...E....p..]..ln-Ed.W...V.J.....iB1q,.k......&.C.t...a...9.......zc[.\q..3.q|.. ..0.j.6..\'{DN.-_....]..3..._n.j.....(.Z...#Ao0p(.../.....u.`..N...)..k;.9.J..G.V.5......&L.M...w9.....:D...Y..k..'......^.nw...v..=..~.ol...X...y.:KM....*.j..UR38..-...H.$..g!.Tf4..T..)Y..p..H7Vq..b...@..{Y.h..I.k..U....T.]...w.....o}.hnnX.;B....Ql.;9..J@.j./L.......g......)..]M..k \.d..QLT.rK......+.....;..aq...q.4.X.UE{.....U..=..4C....Y....@...........ZG.14&...-.].e..........U.RM.@e.-m.2..".._*.+..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\apps-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):5116
                                              Entropy (8bit):7.785549731148004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E8AB122913F6331D1BE2E10090EC4BEB
                                              SHA1:0A2CBDA845AEBB3B1F7C785DBB226A67B8A53C50
                                              SHA-256:5CEAFBBABD7E33156621CC018DEB98C6049C5E4242A9A4CDA07D41E2DED165EE
                                              SHA-512:5D05A508E8C21861EDAA08EA4C4BEC77ED23E7A4B8E5897ABB957EB3D93C1A50860BC4AB525D4C3E3CEA1EAEFBD59D843A85D49DCF1EDAFBA8385278C3D62F52
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.H...W...j.....".6..".....,....X...V......PeF.+........y`...%..%A............2...=o...;...M\.....;.^.x.......?../..ZU...... .........zm...\..9..%..P|...K...G@..D..R..<!C...C.xD........W.G....D.."....A." ...a.h.aM.... ..........M.g#.pGt`..`D.....,.=[....#..e.....b..4b."M...P.{_W..b.....i.........A.&........D.K..q ....~!..}:<Iz...F.....K...,..\....~#..........V...A.:..#.........x....`U..h...R.[a....A..../...G.jP..c.7.h......a.0..k./.>P.....L..*{...z.f.H.U...&..................:...=..%.......6..#...K.....4.t..9[3..S.r...UU-...s......%p)}..M..>7...l.B..... ...lhy,ew.|.W..*..l...l..{......M..}].2T&.S.h.f.;.g'..K..kM.)..h.."..`'..j ...Hh.Nl..I.....*C3o!..sV}..........8..w...A.....m.&%.^.....J.QU.$.Qk'..Y. .Z............T.?s. .V.$.....`CID......n...d).2.s..C.H!..O.D...N\..e'.b..".<{..&.zPv.Y.........~....y..N".,D ...h........=d#.Y.@$..J8G..1..@..`.RO......|..";/"n.KZ....H._.@...5<Y.H

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\background-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6362
                                              Entropy (8bit):7.6434342871391205
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85461A6F6C12254FFD3E73C2C185255B
                                              SHA1:11C3D792B45C8CD96642C69F2990E1AC87BA8683
                                              SHA-256:56B9EF8E20D2B2BCB81677C38DBECA96B620BA8E9302CB46307C84D49C0B9221
                                              SHA-512:EB28CE2EF2DC19154EE7039BFA58A65EB3450E3ED0E79564DC65E831B784775A264CE76B1030787CED70BC9088C4C0608797FB12E1062A416D31B91C0C3C89A8
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...O.\Y[.........q.r.J.....H. .R..Fp...tV"..l.W.(.+S....b*.%...t... ....>...d&.]o.[.y.R........S...[..k..n.%C......:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:..e_...................0p]..{g.r.}X.a9..q..7.:.^.Y9ND.A_O.G....F.X..............5z..;...<^N....-..G^.G...?5...x[.C.u...]/.S1.6..r|S'..:.....6.SQG....u..5...<../..].....a.t...x7.+#.t.r.y.{.x...M...1./..0.:...G....tT...A.46...0....s..]vP..DO.}..'./.rnX....N~...VA...|..........W}..!.........}|1..x...}..>6.,..i...k{...5....._...g@....a...M..i.zg-.&..w>2.@R.cb0j.9.A.e..>13...>+..8..(.z.$l.`w&`.N..wm.%.\.k.s`E.......... .............:. .............:. .. ..........:..:. .............:. .............:. .. ..@.|a.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\background.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6210
                                              Entropy (8bit):7.6791488226304
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C05E3D57166982B36F72C9141E70AE4C
                                              SHA1:80C8AF90F854F88AE1916CDC6234FB94957E6331
                                              SHA-256:963C422EB9C17C9EB725064F6A1BBD34673290C66C112C1E269942972917EC26
                                              SHA-512:451C4BCEF4DD01041085207DF7FF6CD0240F242372F2A3EC97E2B22FFB42D5540F45D5640428D10C6A7FA702DF2FB3FEE1B2CBB8CE98361D3B6FAC253A4266C1
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?.%.Z..oe.*^.6.....I.D7..^..).7...73..HDpf..hz..l.......l........jb7b`.H._....SU..<..\.S.O.N.[..'../.........O.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A........t.H@.. .A...>.&.n.....q)....=V...R.N)e..r?....m..Q).P..'....V.WJ./.l........rP.....j..?.'....wG.....Mw8}a.....S.P<.O.o.......R:....[.ek...s`B.R..;.4N.o....<Y.)/E.A..1..N..g.~=3s`N....i.._.;...)?A................................u.j....N......Qo.=..90s..,.F.C..q...wu...*.u..(.\...A?......sVOLY.9p.....k_t..6l.68.~.n.c.._...9pK.u..A.[..{......V.....P .q.{.n...F..y..Dr....P...3p'.5B..[....{.@..zr.]mzC. ..Z....!.....j...yk....*A....G......@......:.$ ......@....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\bookmark-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3558
                                              Entropy (8bit):7.0805186091359404
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E602BD2EAAE1487976CEF536809C06C3
                                              SHA1:E7457D0F3F003C61443B6A63F74D5848724C6B8B
                                              SHA-256:060DAEE6529562436CE5BC128AC5546694A38E539D2D52C81634D1C3086ED7C5
                                              SHA-512:0E1A939E4D1EB6DD5B5042FBCF10E9F8143F75435A9FBED0A8BB45930B51D7F6692C407CD40CA307C0AD91715A890B08193D21A8747D2A6A1A9CC33CCBCEEA32
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q....aq'..A.....q*.....p+..`........k*X..*.=."......KG......5.....t...r...i..!..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.`#>......{...H.M..|n...f.}\.<n.F.h.!.t.x......^.O.m.. .B.........,l.....l..1...k1...=..].W.3.....c>....`Uv..9..... .t%...z..i..8..=...7#....mf.....vg..........o.T..8.a[dO'..a;...(...".u]....._.y.`.a.>S.Ex..Ly,>Of..dat.....n.r..Vx.....mZ.g.E.Y&...zA..,....~v.....0+?69.t.{.Mj.&}..x3...U?S..Yy.......x..*3s1.tJ:....1...'.U9.]....o.*........gU>S....wP..<.~.a.|^..~n.......j.j.$.. .:..J>....o({.I..A..7...?(n.T.m....AA......<s...FN..t**..[C....\)....2...:{^..3(',...!@.iZ\.sh.J...]%=..Os.rO....op,.AO.gC..$ .=Pay.._ew..<.tZtl...*\..s.e..:.....SC'.#~.........I.L..T.i....xe^.y...1.:...3.;.~T

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\bookmark.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3940
                                              Entropy (8bit):7.0286072425339245
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B46922B5F5859D148FCC205561C4BCCF
                                              SHA1:08331C736DDCC848CFB4948455167589ECE7769F
                                              SHA-256:0D45701B1616F798F50C665EE0454665098CEB38AABEADBEFF74A2925BC5FFD2
                                              SHA-512:9C8A7872B5121ADB88536975E2ACAAF71C85C751DAB7970403CE58C8CEE2F3F5758714D9E29F9F89177CD4415D30631D13E6719BB621FDA77C413BED7614CC8C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G........#......E ..t..E`..P...H.. .K.@.\MU....3.3..<O...?,..=3=......}......'...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@......J).k..`g>....z..x....^.}@..{b..#.}.D|.......A....7.......%.}.r......rVJy......,[k.I)...#f.m.....b........5...>..<.C.m.s.F..v.9...z;........'...`.'777.pY.ui.@/..A..........Y.......K.....&;...8...[....}9{5..7..z........d..w..S.....3...r....e.Y.=..l.o....L.:c....-|......n.8.w]...t..}..[...z8.`......c./.h.9p......../c......J....#.w..e0C....7..;..My'.9.}~......].#Gd8.~j4s....~..9o..c.$...!...o..#.......{.I..0.>...>A...{............=.[.B.@.>..A.....M2;..Nq}....z;J.p...0..;...]...}atG...,<./}..!.>L9...r..?.z..^..p...@........r..$...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\calculator-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13546
                                              Entropy (8bit):7.840507499919628
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:38C564DB0D0A71004941FA2D14064D48
                                              SHA1:CD0B647BC7AAE175A450C5102FCBE8A215FC5428
                                              SHA-256:D5A9CF7EECDDC7385D0DAC1D63E813DA4DE46F5DE0B0EC4A1A9F7E371BD65503
                                              SHA-512:E7AE46210EE29A16E0D6F591290C28E58E50CC8173DEB2B4335DCAE5FB6108815162C76AC4066DACAD56B36F3D6D569EC773F2C93C56EF9F43A04ED9F190CD12
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..4.IDATx....q......;.....W.]8...@..G.q.F.h..(...].Q.."."..Y.k..d.z.t...TQ>u......u...~.....@......@.............@...@....:.. .............t..@.................@....:...:.. .........t...t..@.................@....:.. ... .........t..@...@.............@...@....:.. .............t..@.................@....:.. ... .........t..@...@..........7%.w......5._}}....'*...~..........~..A....q.O...Q..G.i.K.Wu.W..@G.....D_c..@.._..... .a..2..k....b.{Q...r..8<.e.^.s.. .w.... .A.. .A.w:..?..uA5.db.O......2"_...23...n...:.r.J..:...4..{....b.OtTN....i.6z..........64.."m.7....{.0/..y'......g..@.b......L.. .A.g..U.:....uX..z{V.9..5.S.`....\v.6....7.... ....a...F..z.a^..\.~....*RE....FI...%.......ZPy.=..E...!{...$....[2.......[.zN...=Nu...g'.h..+\.....'...p..a..U|#..s.!I....j.cI...Uf..C.V....7[p..@..5..t.=.~.l.....#r...o#.Y[]8..!...-....~..s.).."...t.a..m&..'.{...|3...k.H..+...s\...=9.a..DF..F-.k;..#...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\calculator.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):13146
                                              Entropy (8bit):7.87790699881918
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3A19171403EA203AD802A1A9705AA48E
                                              SHA1:6E02C249DEE8EE310BBA114FE92763BDD068391A
                                              SHA-256:F83E490BAA93CC364728423E0E27E09059FD55811988173B491629D50AD9BF17
                                              SHA-512:66CDDB8FF07DE7312CAF835C75BC86F1E88913AF48E1EA84F66789241D21620DBF54769D5BEBD221E2410EC823ADDB8C90595AD4421F9CBF088712732BB43AFC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....q".....?.-.m...D[ ..!.D[........,h.`.....`A.Q.<Q.H-`...\u_....1.#)......_...(.......|.:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@...........:.......8@........]..cTUU-.Q.........WU...b*...~..{..l.z4.=.{....A.}.z. .zY...D.c..@DM.?.....^...=. '.....}^U....'.=oc..... .dc-..C.a.{...c.I.....M+....z.yiV.?VUu....P.%C.y......0%....N...Z..w../.Z...Z..rO{..wk"-[....72...z....4C..q...g..h.!...r..B....f..o8..rO.....b.....B.'@..S.}..}...@....z:O.9.....FDD.=...me..K.xD..Z.+...T..z.(..f5....k.......Q..ann...\z.eGL.#...i.,..O...2.^t.]+?Ro.#....Pw....;.@lC.gb.b{..gG9C,..g.!.m.?H.0....5.J.ci S.0D..13^.w.y.1A. ...=.._....l1.n.z.}+sZ.9....gm.p..wC...=...3.r...H.o.....v.........@.,.`..z..F.F....T

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\compress-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2418
                                              Entropy (8bit):6.186190219016972
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B95657FDC0ED722B7B59988159F1DEED
                                              SHA1:49C952E6D97DFEAF9D2D44A6EB5EAE8D2D902241
                                              SHA-256:ABFFC1D0D127FFB321F25AA781BD07906B38940A839AF2219C71DA88234BC09B
                                              SHA-512:271B1887854CEEE8541517EC5278C84BA97F685458D3550798C6D7A7D6899F85CCF6CED072CEC0348DD910E0E25F18691AE1221613FEDDA9EA727FDA25C828B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Qn.8...R.$....[..&UI!.p..}O.....,.1.p.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. ...........:. .............:. .............:. .. ............ .RJ3...j..).0...B. ..y....."A.......{.....:..:. .............:.p8.9Kg.o...b....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.......l........:......I7e.5....o...G.t.9..3X/.....7g.4.....o.. ..x...[+....Nk.. .`..=.A.;G|../.g.1.tp..=.A..p/A.!.#..............Q?j#_~...._.%(Q.]....'..N...z.^..O."]....#.E}....H... .z..". .z......>\D.v1.AG.....#. .$..i". .9.:.:b......b...................m.b.....T...:....9.:.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\compress-win11-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11109
                                              Entropy (8bit):7.901190719858024
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:132A10EB5E1E8D0C3653FA7904AC7219
                                              SHA1:CCF274AF86795D875AF1CA2EA3804765FB74650B
                                              SHA-256:CB85DDD4140DB433B16D018C096F95DC9D513580A436C9ECFE8CA276E4E6D6C5
                                              SHA-512:7E3291BEAC639933CB93C614FD424B68DF3DD3E2B4D54D2B7C59DF4A884AD8A4C1E2BF3A964B9BCC46C9B8AFEC8E1437F9DD78C9FD72FE854E62F58975F0FCC0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..+.IDATx........^.g_....f..A.1Qb.n.bL.(...B..%..U..."...%.x..\.z...GYT. .YL.7...,. .l.>=.U}....f........yJf..>}.....S&Y......3....a...................a................... ,......F....=......$I.&4...V+.L&.....)..e.,X@......Q...zi..3.n...../...'...i...t..g.g........:;;}.h...M..zG.,...8....!..dhh......Z.VQQ1....m..Rj..JN:.u,041..P....Z]].N$.*...L.UM.4..!..hf..!...J..m..[.8..H.RHk...445. Z...///gY.;^V............o..#Gl..~t.`d.....?<.I.X..JKK+l6[..{..v....g.W.\..G;a.'..d.v4Y.'..BZ......j.x..QVV.l.-..\p.+8$...../i....?!R{MM.. ....-c=~.....UPY._.....rL.._WW.D.....^...D..n/.9s.....SY\3f.X'...U...&.wB..q..%-#I.e5y..%....r..]E.. bY...i.8..P.y..Y...BZ..&,...........~....o.i.0..n.... rY.....8.}..8.............j..I.TV#$....V....Q.kWjww../....'.5.d5.q..8q.h.V..r....n5.\@.ZW\\... +./l....o....5.......n...j..^)...iE..B.....w477.P...j\..OZ....J...BV ^.....Y.f.m..........`...<.(i..9.........?.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\compress-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 370, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10904
                                              Entropy (8bit):7.89489583157688
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F22D63209A5A6DCAA8A0E6BFEDA461E2
                                              SHA1:0963BB65C05CAA6C8C67334550BCAA16173239A5
                                              SHA-256:54D85FA0965D229616DB4FBAE0951DFD473557768DDAADBF070EB11B48994014
                                              SHA-512:84A6F9B02DC4D404C133E19A3C98046C0C9BC42455503BBF30DAC4CBF61740F7D1469695689C9CF31CB95AFFDDB24098782235FE706C57D434159C572054F053
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...r.....O.......tEXtSoftware.Adobe ImageReadyq.e<..*:IDATx...xTU...S.H..@........."M.tm U@..W,(.b.dE.U.....PJ.E.Q.........z....i....`.$.n.|?.s`..;w....9..sM.(.....3....a...................a................... ,......z.....n7.Z..{YY..L&...4f.X.........e...J.7o....*.]..*((.w.}..s...]....:.KJJh..t..e.`.u..y.t.T.......c.m.".kW..~..h...".@..6.5u..o.....aCV.|....G....U......:.9s#{......{...:.......OVLV_. ....>g......5..<m..YYY....uI.....%..\.6....dg...4...'..z.jO.i.....KKII..........|s>.'.......SZZ......O...QV....s|.1.MZ....n.Yl?...NPP.*..,.P.....t:.b.za..]}=?77.......:.(..N.qL..Z.~...>.......<.>.h=..?T:..&O..EUa...r.:...OZ.t...T..p@.@X.1t.....gG..}...vSMX=z..g.y.c.......:.`.O.}..}..P ..d.$...5..\Z]U...;:.\.3.|.....;k..X7..*...B.S.`.wa..6.>...?..*....bI.]II..Q^Nh!.j......r'+..,,&.$?eUm.]Xw.q.=..C....rKk....LV5...B.[./o...Gay..?.8..^z.n..%d..K....7YM../........l=.+.du#.&O.,%.....50..R(iuQ.r.r7>.....wa...C....c.%3Y.(.q.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\compress.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2537
                                              Entropy (8bit):6.997974437426367
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:243E14723F0FC50539B3756AEAE1DCA8
                                              SHA1:5D7EABA4E933D9FA5F7723FC2A5EA3A80E012187
                                              SHA-256:290F77CD07E5420445F0C00037C3CF0B8FDCF16B413187150546637AEBDE8ACB
                                              SHA-512:5285D43AC577E7920A1A16FBC8BC4F299FB9BDFF524142BED6A34AB554546A910E9FB39743C6D06D9E5C4724FCB49289254CA998B3986AD72DA67DD97720BA31
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E7317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E8317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E5317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E6317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;^....PLTE......U|.l....tRNS...0J...:IDATx.....@.EQ....W.^.m.**a..#P=.$.!...,.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\doctopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9731
                                              Entropy (8bit):7.935009909175711
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:731497A5EDF4E48CB3BE79A6C5033A86
                                              SHA1:ADF3C9C8A974C4EC29061BF3EB07D3022397C196
                                              SHA-256:D048B8608F0DA43ADD656CBE1F87696897ADB002BA73263862DF5F120C2D31C9
                                              SHA-512:B6594DE513F4664848E9ED3EA012A42BADAF43B5E404A844536AA375E4498FEB17A0C0DD30C3F10044C1647C961D0F87A24EB851D7E667DC73D8CD3D8A673DE0
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.....U..O.k.g...{..$...$..D^...l`.......1Q..?..jD..@.... D....HB.@.....$$@...3...V.$.d.....u.._.&.N..[U_...S.*.1....p`....,...`.. X................,...`.....,.UU...^...C.....b...F..T.0.~...O..4..u.L.UF...#....t.;/.....pb`8....p.Br:1.._g.........z{{..PyC.Q.......f9.J>......<.M..c..`..yeO..K..._.=F%......x<..B..t=*/.R.J[.*...uW..n."w.g|",B....j.;.RHq../..[1.....6w........q....3.....Z..K.<.2s.......e.T...W.N.E......<Q?......8.`........e/{.....&.J..h.kB...b.......j/..w..7.4P.5..%......=l......_..5.W....v.s...Z........j.....cN.m..._.{.I.~.l,.e.....DI.....d.q..r.`.K.,..M.^..b..}<S5.A.Oj...HL..f.]...;.....@..RC...33?Q.>y..R...Y.)lH.b..EU..c..cUI.''.....,.%.]RFm.~..p^.v.C>p(...sM.{..Uu.\.i.~...........*&.p....r......".F....X{..sq...FX*.4O.AN*.W=TAJ.:p2).....Y..w..6.F.f..S6.j>s..=a....8.1.XkxF...x..S4.?..T.u...."{6c .=",.. Wq.h}b.......i..~r.=.{..z.=.1-x..{.......B..W.HK...N.....b.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\doctopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2875
                                              Entropy (8bit):6.745735545015004
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BF28055BA90665D0DE378F78B3DF31CF
                                              SHA1:0EF233DF63B1187C58A5F9D84F5D19E538DB60F2
                                              SHA-256:25E30077F6B16FA7EC1863F796FB9A173BD2E18AF78C6A16D991BDC829919934
                                              SHA-512:7E60B525CADF6E1C366E6282CC1682FBA30F4811558E2A46E13BEDF8A96669D7F607EFE223DF0D1EF325B2EB39EDEBBF48FAE039C696A0C9ECAF6D2D2E91051D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...[n.:.@...4..hN..a.0..%..y...@.5D.7O..._.@no....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...G......:. .............:......<..L...y...l....B...$....:........g.....A/......u...........u.Aw.c...:.:@.{.?.w.kF......4.......[.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....y.....:.:.......Cd~.]..A.Q..t.@.1....G...*...cZ.@.1....{.<=.{k.@.)...\ ..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...{.@..q\.Bn.yn....BN...vA..`X..^..f.M...^.._Wg.k|...........n....ze...q...1A.p.c...........8...>..)..$. .........q...9+_..[.....p\2.g..w...^...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\doctopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12763
                                              Entropy (8bit):7.959469369018976
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5402C9B52D057EC95082860CF17D38C3
                                              SHA1:6220262F5AF3400A9C4CD405827FBF867C997C43
                                              SHA-256:B681AE82809802F0875C047A0B09AEC960798BFD58715A071A8C4A02028DFF2D
                                              SHA-512:F5F0E37EBB8FA4CDFFC4AE7F08FCC164899636ECC3CCACB23D92022D8DE81D393A82940FCEA5341F5C8B27FC9DCAC2E465D3A7C8773D78538C35DF197C5B4BA2
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME........G....0.IDATx...y|........'...@..Z....-)..-ei.)y....WJ.....5..@iYZ(-....B........8...m..g......H.dI.yt.|n?....F::s..;.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!.d.e.`..)..Lx.\fL...BH......q5..tz......d..../L......?...w.....CH.K...N..q....fo../..p....Ia......|......._..r..DH1S.....t....o-..G....h.a....q.}....N.Q......~.R..=.a........E..../....C8.D.v.5..~....U.m.?....#...X3......h..Dq.+..X.@.=..`.Ah.(...,.}...7...~..>.RL...g.L...^..TB.f.. 0&!...X. .(..v.....ly.Y=4.2........._....R.L.r..Z.%.#~..)'._...<...b.A$.X....CO>O...1;J.Z...P..6....{....} .).2.l.EK..-....I."48...1|J8..!$....y..p.....L..)...[-..*.)Z. R....*....|.?!...}...mB..8%......a..W!.Qq.Z...~....:...7...bUF.........FdP.!8x4,y...2..........b5...f.1...&..{`.s./...w).5..@H..M..BP...................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\doctopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2978
                                              Entropy (8bit):7.258633461871953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6A68B5D0F31253717E0F632AB9FDF218
                                              SHA1:461E2FC23480D935F6544DB74E6D36B2005C8B3C
                                              SHA-256:825D1A797AA9B12EF2D3555521EC046201665E12512C86BA6D204FA98E0CDACB
                                              SHA-512:4F00FA4717637F052BF5E4B3BDD2C00463F23371CB6A5EF0005A160F798B83E32687ED5991B3C71E48080A6C6D8B5D218FC1C21389B8192DDB1E0CD0B5C84EE9
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB46317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB47317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8930F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8A30F811EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......PLTE......U|.l....tRNS...0J....IDATx....v.0.@...i...hC}.e.....d..,.&R../.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\exceltopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9165
                                              Entropy (8bit):7.924798935651021
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C201A37E52A921A60054CE0970354DB3
                                              SHA1:EC8371890A1495495CE588C242227EF17AAA8B28
                                              SHA-256:79FAD4CF6889C350107C3B407473F753657FE21AE8109CDDABDD697C11A4F716
                                              SHA-512:6821B47A3A7F28B457F0D563ADC89BCB3176036C6D3215EDD5FA83EAAE7D4FD6DE3903FB2022722BB0D821BFFA6F4CD0BF00C566568717713C88C8391A06C177
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..#oIDATx.....U.....w..{zK/I:...!@@.$,....5.1....0..8. ..B.......]. .H 2.....u@H.,......9u....;u.:u.7...sO....N..?.c...@.T.........,...... X......@.........,.@i.........N}}}..w.......->j<,T.~l.A:.....x..r.....TZ...=...\.).........-ZD.......,[s..........._..M.C/.?........f{*].......N..=.n...9.^.x....`0H.....z1.N...UUU..,O.E..6.....y]Gi.#-.M.....Se..O........V.....6>i`hv.a.]./5M..(..[G.1.-....1.4..*..R.E....iS~.|.a..U.1(..".}...3...HY....K.A.l..@{\.F.~.....u.9.v...I.W......XU.{v.S.j.qqC3#*Fhvi{.X.+I.k.....x+.x3.JK..'..y.L....}d...[.Y..k.Y?............../X...l.......x....B..V.ZEc I..5.*n..d..q........)=...).6^..5.d.e.o%t...>.....jN}.nA.H.b.#n..._. ...`c..I..h...S.i.7}E.......K..T.h(4jZ.k........_...;.....wy.....4i.Z.Q.iu..>...,.F.v..."Z..2....<.pD..o...Z..)...V.(...R......8.oK.:'.<Z.o..ta.'p.`).....Td.;s...j..;+.9...7.!...r\...X.....0.'.Q.'I}SZ..^..kO..8.A..4.3....[....p.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\exceltopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2901
                                              Entropy (8bit):6.784887451836086
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2FDF303BF99219D666ABBD4D5385C95A
                                              SHA1:C6FF719F84341359613F76C3F36356C013901907
                                              SHA-256:C6C80A943237A103911EB40766F51DE9F67926A44F6FC5F950088B7EB6512D43
                                              SHA-512:1AEC313133455B0D03AA7B6078481C942B6974AA25CC5BFB650CA4CCCF68994C6ADF116D8D32A0B92CAE83C7985B75A0A337525FBF1636CA50547217671FB275
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Kn.J...(.....pO.<. .-......^ ..[.uI..k.._.@o.=...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t....._p]..2..m..S...k.k.R.E...A.rQ..}.>C..|.. <..zQ. dBG..h.t....`BG.....=. . ...,......_om....a....-w..|.A7.#...... . .......:.:......:.:..#...:.. . ...... . .......:. .`J..t.u.AG....D.@.A....D.@..u.A.Q..t.u.A.Q..t.u@.A....D.@.A.......L...... ...m.K....D.@.A..A.St~.]..A.Q..t.@.1....G..Q.U6.A....cZ..c..xzZ..6.....+.@..........:. .............:. .. ..........:..:. .............:. .............:. .. ..........:...x.@.u]wO..m.^....BN.Z....>T...g..^x.9W....=>Cw0.9m_/b.LD.....=.:.*.9.L.tSz..D.q.c..].m^..c:....#..t/.@.....t.8...e.._...v&...kv.....z...M...(..q..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\exceltopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12076
                                              Entropy (8bit):7.959810568382396
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:317256494130755139E9003693AE3911
                                              SHA1:C7FDB305AB8970E168BFA085ADA82E890174A892
                                              SHA-256:7301453F9D3EB7BFEDDB61468210C1818C0993DCB1ADEC1E1460D72EE7857A0D
                                              SHA-512:FB33DAC5400A50BA933BD9624FB2AA8907FDC1539B3ACE03FD0B5F45BE68330AD34073ACDC4795A326F9FAA016B6D48E79B7C8228C2D21ADE9F4CC75CD019C14
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...w.......H..|..r..9.Bx...4.M7%....@(.P.^...iq.....H..v(6...`..L...w6..........[.jO.|.......H.}n4zf..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..BH.X2+s..f.8..dav!.!.n..3...Sv..i.'8.)..D.........J.{v..../.].BH7...*..t.......4p..[....6n....W...........!.N.......-.....g.......v'...;..m.N...`HQi.c_.mv...e.".g..u.U..O.?%..kU.'1...a.z.<.!RQt...U...o..7.x..$..?N.....F.M.q..re........_.s.......E"$.....G.<... .@...}iO.#h(*<W...7l..b.+..\.....a...................O..9r.gr.P.+..\"...?[Z\3...m..+....d...a....3..."6.........{..../!.@..................|.+..>...........9.z...Z....q.%...<h.G./.-.^jv...2.f..nz.Q6.....&...1.o..F.6.B.....Q..w4.$u.....R..1..K].......O...e.S..H .{..P..h....5.....6...%.@z........:........:..[..~vix.(`...b.m..../....OEcI..u.,s..].XEk.2;.d.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\exceltopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2968
                                              Entropy (8bit):7.315635630714097
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5DE6AE7F46356F9A336E7B774BA74FD7
                                              SHA1:CFC60543ECFE72D2172BEA95DE8C883A97356D83
                                              SHA-256:EA6CB8676E3F5D5934E08D5BA2160D87AEF48C30944F75CFC677C24BCC8D033D
                                              SHA-512:C21C286628AF464685A8991DBBE75AB8876F6065F5D9BE59776A4DA42C86FB7D6819A0D82AA4A2942B4367A05CCF7CC120B68DBCC4FA3DD2A37EE2480F54C9DC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:190EDB4E317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:190EDB4F317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB4C317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:190EDB4D317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(.a....PLTE......U|.l....tRNS...0J....IDATx....v.8.@......3...JRA..N...B..C../.tA.tA.tA.tA.tA.tA.tA.tA.t......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\file-explorer-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4639
                                              Entropy (8bit):7.398169764221836
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6003355839B831BC685100FF39A4FF70
                                              SHA1:0391ABC3BE6716A0200C43E20C00F1692E0C15F3
                                              SHA-256:40436EEC35A3590447FDB48113E681BB6381990C6F80CE7771A0CCB0212C5245
                                              SHA-512:353B45B8CD42332D92CB5A21A20B982E3DE9878242017F5167DE545C70DDC1845B354FE2CEBE36171B4752BE8EAAC04B0E34B9ACC5E40C673B1C9BAD43189CC6
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]R.X..a.T.a....*...z.qV.... ..pV......a.1+.X.s. f...@.d....+S8.X.#..Owww..0l.2.. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .......t.@...A..A......t.@..@...A......t...W.`{&..nz8L.4-........mZ..e.^./.......B...h....."]..T..A..L<"~..=#B...3....0B~Z/;F.'|LQ...@....#..7.......8..t....b.3....&.?.....w....<Nnzc4..>......nb.2+.AoS...,...9.;O...0....: .<.B..u@.=;...c#...}...|...4.l....Ao0..y.P....u...>...[.y...a`....mp..o.~.D.0C.....>.uZ........n}....h...z..:6.M\...........&^.6N..u@.;...J.,m.o...AQ...kkO.7..q7..1/O}...-<....f./.].a.M.w..[cb....w.$3.q..a.L.....g.: .=.s...!.w...k.3.........#...a......!..;B..Nm7.g].....k.U9@.w..f..!.oD...<f..)..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\file-explorer.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4901
                                              Entropy (8bit):7.408066314653426
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FA677C8C4367CE1B63268E25C46045AD
                                              SHA1:CE25384E6E4FB8C903EB6F64EF26575604EB1B61
                                              SHA-256:289F3D019ADBB1222018F749339F77A3E282DC2513D25AD777ABC4CF031D2189
                                              SHA-512:BE42AAD8B78053463E082D161544FBD0E116175CF0C717774DC4518B6B92151457D534DF08A4D8C457D53FCC9EEC7B44AAF64BC10F1E6372829154A929B1E1DF
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....Q.G....[..2..@8.....@8....G ]....G`..!.C....kNH.......Tm.;.evw>.....?..`..........@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A....{..j..rPJyu.o..c.t.r^.'.O.I}...g[xZC..j._$..<.S)..S..i...;.._...RJ.`..S..q......_...V.....9....9.xS./...J........gQ....mkm..._b..../..........m|...z......7......d...2B_..3......}qb.D.h".s%;S.u`e........D.z....Eq...`.s.O.8....".O..j...M.u`af.{..1.V....{Ug..b...OQ..e....R..#.}W....8...qG.~.4R..%.;.3.v..:E..r.......R.'.......QGn.S<Ifk./...u.Qn[{...k..^..y....?6....2B.o8lz.x..ov.....d.~.ac..9s0R..F..;l.y..K..p.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\home-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2021
                                              Entropy (8bit):7.225339944088351
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CF0C3CEE117AC517E9A7A77D97ABBCB6
                                              SHA1:7D12FCFBAD89273DE897F298A5AF15AFE76F4FB5
                                              SHA-256:596F4B7308D15EBAFBF3A4D97772FA0505335D4476E5D841D43E811B927FA1DB
                                              SHA-512:EBD749738AD0B5A0C5E14B3BB0B9D33EC461D203810D1F19C1CD1338BCE1A7C1C46F556BE675253853016D8C41FEF51B10DC2D7B35200BE9B0BF72CEF3238066
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx....$E......)....<.,.............H...W..........q...?].......7.........!..@0..`............&..L. ..@0..`............&..L. ..@0..`...........p.|.,...C*..v..).C)..,_..?..@.G........E ...:......@....h..=..........W.\...`..@...q..+..!.....%...`r7...........%....Im4.J.&%..Z.....7..%........N_..LF.&...+....L...+....L...+.......W"08.....D``.0.eY.w0.J......,....u...U.....L../...#...|....D..1..+.....`..W"0.....D.s...._.@........o.n.5..[.....4........t.S...5..u]O/+.i...t.3..#._.@...@..D ......W".C.....+.. ..y..=...w...............................:.9..hh...W....FF..%.....f..%.s....4.J..!.;.q....A.v....Oi>.J...6.......y..r.p\..6.6..J`h.....W"0&..H..+....l...".c..;...D`..p..'..3.J.. .7:.....C}?..+..........c............z...%.W0..@...B..?...\...#.}..W...D....<....)........z>.c6"p,O......t.X.....C..#.g..,.8....7D......_D.....pBo".h'6.#..H..|....v......w.`.cq%.......D`?1.0....>".`.s...M....lk..$..H..3

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\incognito-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4730
                                              Entropy (8bit):7.750028693045957
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A04DE10AF2E036F58EAB6B242BE62309
                                              SHA1:F3E7B54CBF8389BF893F627D41C1B93377A4E87E
                                              SHA-256:F1E1A366D357DBBF22896CFF706A2836A29CCCEF99F9274B3B5542019143F513
                                              SHA-512:66A5A50ED2456C32CF9ED9B4DF14098663AF18C8763DC1749BDE144198E3684BCDEE7C36A077FEBDE5382D46F21D4E4DC2E9094651761186E915BFDF726ABA85
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....,IDATx..n.........H@.vF9v@:r..'...DE....z........3s3;27pN....8p`...5..]..VwWw}....A7;;S.w............/x..~A......8...p........1...c.... ...A......8.Y.?=.x.Bxa.V..'].].......c.._.....,.P...>.80p...Y.v....@.T.....l...........U.`.. ....[.. ......T.C.,...`.2.B.....6.....6.....@0....z..D.~T...... .....X.Z#......N.0..(.@&..."U.R5...|..C.?+^...H)...c.Q...t.u.Z.:.1...^..?..].... <...J...V.....@...|.P/.@Eh>`.....wJO.:#.6..|....h...@b4.@....J{W."..`..2n}.j.......T.. $...X..`.BJ\...3..@X.K#..`..*\..U... d..0.. $..X..`.B.....2..@.;#..`..&........2...........A.0.!'..@W... .....I.0.a..|.......@.....Y.f.Z...@(..#.M.....pc.z...@.......`.BA...`.B.<.......J...t..`....0.=... l......`......`.BQ...V....,...|....;....`...4......@0..P..@0..#..`..%.6....0.A.........4h..0%...`.. #..`..@k.....i..l6....E.5.[...@.Y....`..a...`..IZ6.-... X.I#...........`.B....L... T.....@0M.F.......h..l......4g..&......|.........$.....E#..`.BM4e.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\jpgtopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10390
                                              Entropy (8bit):7.944868066313914
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:518EEF92AC5EAC5B5153066858E80B40
                                              SHA1:CB92926A0F0F4858CF00AC327F217DEF88E05243
                                              SHA-256:CBC619C968C729BF63BCFFC51652761D5CEC2826824BCA0E45923ECDF8DE0D1D
                                              SHA-512:00BDE37BE087545E7EAE8458617808A05D9CF2F46E698E967FD3526C49A940B61D4784DDA8D6B3B7DD832BC0B0D96AE7370C7C88F627FEADBD71CA886E84B382
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..(8IDATx..}..T..w{..}g.dSd.%j.70yIL...F....<w.31q.K....Q.._....F.M..b4.....0 ./=.w.[..v.".L.L.L..s...0s..u.=....c.....l....@X... ,..@X... ,....... ,.............C..}..W.W^....|...S.0.........N&...W.o...<B..7.v...[.1.m...^...8..;.8tD!...+..n........'.:...Hr8......6.....>.....Ok%..S..9...V....+.=^....;y.W.{..+]N..".a...V..G.T....}./m.r..B.."..B%.=a^E.]5s.5z.....Y"..:..0.b.%...yM.....^.l......8...r...#.+.z..b1.MI. F.p....F.h0v.]..W..&.Y.....~_......BY...VR|)..pyy.z....../.......Lk...t.....e.L..J.].WB..yY......aC..P..u..s...}...q.e.^\n5G"..l..7.... -.`,.....3..6.j..@.....i....p...........$.!`u...udE...s>.J1B..H.a..U...x..?.J.k.V..C.O..c.u.v%I.(._:sl....5.Y%.X}.X..~...d...L.q.d........H..f'...Pq.}|...vt `9.uhM.~...h.A..oQf.-.\ps...3.K&.W..),f.S..M..RaQ....'..q6..}^z.....w4!.......-...q.s$.qg..V_2j.....J...-..i..dK8\..S.....-D......g.a.%.7Ca..:c.....+.:....w

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\jpgtopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3031
                                              Entropy (8bit):6.862429331136116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DF5C095F9436299B72777453A930E996
                                              SHA1:EC249D87FDAE1B3AE0DDAF5824EF6F38CE853517
                                              SHA-256:201829C027D8301FFDE73329F44782AC7C64A87E55E47DEEA64C25DD2112FF70
                                              SHA-512:C947E3D1F31757E32A0751C47D065B3F67EE5465AF97BB38F2F536A855EE98D2703AECE874F4405FB60DD2565C2880705DDF13E20F619F2D141FDB7D7CBF7624
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...yIDATx...an.8....t...N*\ .a4.D..g....v.mD.........~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ....e.?..e.o......c....:.......yC}....Yc..A..:.I&tD...A...:.&tD.@.m.....D.`.K.?.g.sF...-..A.....y.TS>.....u.A.Q..t.u.AG....D.@.A....D.@..u...Q..t.u.A.Q..t.u.AG......t0...:.:..#...... . ...... .:......:.:......:.: . ...... . ........t.A.Q..tb..!...... . .C...v.u@.A......tL......2..e..tL...:.u.y,..wO.....t.F.%.. #o..........:. .. ..........:..:. .............:. .............:. .. ..........:..:. .........SY\. .u]wW!.m......BN........9.U.....m.....6z.t.px.t..<.\...u....c....D]..@......4.;.._o.M..8..:..Ln.... .!....^p&+.t..}.......4y..^.5..:..D].y.d..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\jpgtopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11676
                                              Entropy (8bit):7.9524083655299345
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7B081E5D3417489FFB4AC7C6F5D5EDE6
                                              SHA1:13573EA856D07CE1756A9ACE3731C26EBD067627
                                              SHA-256:565D732942FD64F1CF9567CD77D5ABCBA197759E1FC181ABD2CE94188D515D97
                                              SHA-512:87BE713045F0BF27EB1537797388AAF295490E5302754BFCD97F3FF9328CA1CFE66C9B1FE11FF2E85920176311DEE056F59A4B4BC079B4867C016C105D8AD1B6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...,{IDATx...{...7......>0.H..|c.o....5.fW..<..7q.(.d..u1&&&.$n.k.,j..5./.l|......a`...`....[U...Q===C_........2O...>U}..9.s.@.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..R.X......;..;..D...Np.0H.....c.....:=.....["z..D..... <YK6.q0.{....w{.}..?....=V...j.........E.N.p:..W.l.!......o.G.....g/^....U..EH5.&.....w_..N.......j....xe....Oom..O.{.....R...X.......-^.... ..$.L..7..zrS......R....~..y......~.@...`./....{o..7..j.(...C...^.! h.o.3Kf........i.....y.T.........N..o;*.-U.1.:E...8...;..:....T..............P...mW..'b....u-N..."......'.HY..VBp..N8A.C..../.......Y....:......Z..]f.H..>Q..`[../...7...V.PB.L...O.a.#`4.g...Qd....o../.tr`.....Y.~B.(.KX.....x.(.xe.'#..Wl....w.\d..%...K.....p...`*....w?.p...Z}s........|(.-_F.).7....-{....L..H.U.....h.....~.K.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\jpgtopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2988
                                              Entropy (8bit):7.289385074734729
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0DF122B7DDBDF24351A4F3DABF1F387
                                              SHA1:47B58D6FE2846B0B6DF68F41D17EC4C1D737A6CD
                                              SHA-256:1311E8AD052D19342E925F03EEC4AE461BD7CA1237584C3998F929B18A821384
                                              SHA-512:689B68FBCF099FDDA72D5BCD0167DA83986F109A8C235D3E1FFF54D614A1459345B3EDE9D2E65840D4C4C80EEA482D9CEA2CF267D6AC18A04992E869778E5585
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9429317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C942A317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:190EDB50317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9428317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..e~....PLTE......U|.l....tRNS...0J....IDATx....r..@.....V...\;F..^.1...s,!.DS..K.]..]..]..]..]..]..]..].........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\linkout-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1401
                                              Entropy (8bit):7.406600952001254
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8525A3D4E6C7D9CCC9CD922814A96567
                                              SHA1:79B36A4DC9FE688A5D680D3332FC477696180C2B
                                              SHA-256:ADB4ABFBD7D52D78CEB98144789CE73A5F0008131C0EA389BBF854BCC83908CD
                                              SHA-512:5A5A3DF8F6725AD1D0234A8DE87C15D017144F62DF18BB922D964B8A93A29B08F179BAAFE82B32974E76A32F8D05BB88A48242919FFB4D777341FBA28AF94191
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AV.I...N`/kV.../.0.@<......'.O..@<.......Mf.,...*(x...4......B.|VU.I'[Q.~..n...:}:~.....<.....ps.i.mW.K.....A8z.W...P.$..P...i.}K.M.... ..1...r*.........g....#Q. S8".K{.........!@.......:.C..w.y.J...f.x.......ZZI*.A..;.. i.xoH.....!-.b........C*.A.......PH.@..-......!-..a....(..|.I8F-......8...C\.7.".N..W..>.y~.......l.............:.pW....~......A8......@.. ........Dp."8..Z........Dp."8R....m..&...V.:.@.|.y.O.:! ........Dp."8... ........Dp."8......8..Dp."8......@.. ...8....@....8..Dp."8......@......8....@....8..Dp."8......@.G.q........ p....p........ ...m..8...K8........|n..Y..a...>.c.. *^...).....@.. ....$p...........$p.....@R..8....@ ...U...@ ...-...@ )A.. *A.. *Ar.G}yMz.5.7../_..D*.$..K,..D.D.D.D.D. . . . . . . . . . .......................................$@$@$@$@$@$@$@$@$@$@$."."."."."."."."."........is..0......V..m...~...*)....N........*.qR..F.p..uMWw'..0.?....>. ....9...3.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\linkout.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1398
                                              Entropy (8bit):7.470072684929543
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:01D7D53D856D915FFD7E03892827E884
                                              SHA1:13BFE20C34BC232DC81C160FB9B32952F01F3A80
                                              SHA-256:ACC3DDE8A2064ADFC9ADE1E7D4A4996A9F7243F1D615AA071A9BB9DAA6DA475E
                                              SHA-512:6F332A8EC0CB77328C33A6A19B56A29A5AF3461A5B36424AB8CCC47FA4581C2ABC82ECCCCFBC7F0DEC93B27DE9D6D2B1D3BAC02EFCD08BD315FEB9E40EB6C6E1
                                              Malicious:false
                                              Preview:.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....Q.H..a..I/G...#..T.....B* T...RAH...p*......]X_l,9...I.?#.0..Y.ewm.y..... ...m.q.~'._.EQ.j....$.F.........p...z.$..I N.. ........H%.a..0c....T\J..:...#.._..g.$@.pD.....[[pH......CZ.Hz.....R.Y..*i.H.=.e#..Fz.dni%.d.9..J....!..g.......C*...W.f..z.yg(.j CC!..I.....*f.......A*/..p..9'...l.'...p.Z6.q)..`......}(....K.+].q.6 [p....A...]..8.Io.+..8......H......Dp."8......@.. .......C....@.. ......g..m.....~........(.b.........@.. ......p."8......@.. ......q.......@.. ........Dp... p....p.......@.. ........*.@....8....8....@.. ........Dp... p....p........ p....p."8Z.!...8>....8.()...X....{.Uw......|Ip..|.H....8....@ ...H..D/...@ ...H....Z....$p.......$p.....h=$p..I..8.Q..8.Q..+8..{.../#q.......@....1...A$@$@$@$@$."."."."."."."."."."....................I.H.H.H.H.H.H.H.H.H.D.D.D.D.D.D.D.D.D.D. . . . . . . . . .............C-@...j..^...M.SHTK.t.nv.8..=..HT....N7...o...f'..(.?....>. ....9........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\menu-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4981
                                              Entropy (8bit):7.815816359044219
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:080B438371CDE5D7468FD6AC4B82B118
                                              SHA1:D32B223D209F4E157A0464AA5D1BF09F9FDE3300
                                              SHA-256:AB5A7E915D9D5BD33D66FF685372E7222A838F34268A41DD011D6F568CA4819A
                                              SHA-512:ABD7B372DED71BDF9EB91052600B5697E4EFD27D91AE1A53950349EA0290F7B1F7E4FD84922E3000147E7801475899A5D813E0B499591F859074036873A5BCE4
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....'IDATx...q.9..../_!.y#.207.."0..*........N.`....V.`...|5r..S...n|...J...39".h4..W?~.p.P'..{........{..9....?..9w2.\;...}+.....i.j...K.....!.....=.J..>.}.4.....v..dF .Y ....Ug..=`....$F.?.~.*...b..?.B:0..x.[._.z...........R... .2._......:...............I..q...........#z.Z3X4Ms=..-.......).'...]&,.sW. ......~...[..Q>w..,j. ....D...l_....X.Q...#...D..O..#...$.?.<8..p.@..~P..7.`?........v..l..'.F... ...Y<.X.d.O0...Y..^=...6....C....P...r..=.tY.!.*.@........=.n..p..M..u...e(G...T.,...&....-.Z..o.........\Lb..$+.*..eA5. ..E...;+......1....J[b..;.a....(l._J%....o....`.UD..6.Bf..t....XA..Y.....&k.r.....Z.M..o...H....ZL`r}.&g.2......<NH7./..n...F._dY0.(mR. .EfkL..$.~.K...O...d. ...#..dx.{2K.I....*...%.F.......\.l.+..4.e..1...@.."...+....#!.O....D.E.~....z..'&.#(6/P....o....~fd`.m^`V...g..E_%..Z.. .La|..(../.k....D!d...C)&P..$..Ws0dj$../b....../...l.gm$....4.<.._.<.^...-.|....|.o.{..{...u..@.+....(r.`.y.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\merge-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2089
                                              Entropy (8bit):5.618869080223832
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:22BF7FBA206C9DC2D1D8F3258455F326
                                              SHA1:C4A7890081FEC121F0E8C1709FBB289772E20B2D
                                              SHA-256:7CDD282C78FFA49C03B7A85D855A2F4EE3C2BF83D61C158BFEE108709A8DB026
                                              SHA-512:74573FCA12D8942E8EE6B6EDCECD918BB95B762C5FEBB38E2E930DB1CF988E9C4AAC005F455352A894FA06A2F717B4453A5ABE1CD33DCA168A410BD654FE2489
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...AN.0.@Q.r.....N.X.Am..q...Tj....U.U...pm........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.................:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .......Y,..EDY.F..f.`.Ve.F..v.t......!.a...(N.....c.........,.:6F.. .. .8...A....'..2 .. .8.....ok<..N....!...v8.G.. .8....A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......m..p.....ef..}..,.....F~.Y.zn.t.r^.&..s...A.!G..t....3.?..1.".`.........,..6F0..:..:8..F...A.'.0..:..:8..e.^w.9.MhN.s.+.AxD]..t@l.h....x.....8.c..t.@...A..A......t.@..@..........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\merge-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10523
                                              Entropy (8bit):7.912811927273259
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2402FA00737FB8E4CD722D6CBA6AAE62
                                              SHA1:E0B3B3F5F08AF67F2C30E08705161C5A412EDB29
                                              SHA-256:AF10524C30FADBD9C6397EFF64C37ED2EE028FB60D47E82355497AE8B5F55049
                                              SHA-512:551CA9FA8C62286E1B3E6E034CCFF87DD45155A83FFFF8946B8622F25404B2D6D20B66BD0A7EA5B7DFDB807AB7FF8B5FF4D0C376234C10808B3C220834C2246F
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...'.IDATx...y..U.7.......t..$.vQ............#...2l.....$..:.*!.#.."Dv.^...."{ $.$..~.s.?....I/U..T..~..$&.U.T....Y..@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.vBw.j.....'.T)U0.q[w9h|........Sw...c.N............\..4.eCk......Uo.Ewqh.`....v...+..............4v,..|.....c^...?..H4>0`........6..bD..@U",......_..x..p...7...ot..j....a._..p.Y..z7.yS)..8Z.C....-..p.s.h...h.....Ow..1`.p.....0w.C(.....\.0.....0..y).O4y.....:.<..|T...|xh......].8l.Vr3....E....?p....^.n{2?.O...............p.t..E..6...F...~dN2U..<T{..<:...x(%...)..6.....`.#~.....=.....Qma..h...}..Rj.oP.Y..1..].A...o......w.}.v0`y$......1....U..R.q.Y..4i.."Sm.t. 4.2z.C.\O.p.i|.@...hO..i..(u..m-O..:..3,......P....N..K..<Cwy(.ayT..3.).+|;..m;zjb..5EM......@.......a.8)1a..;..<.N.X^.F..m.-d..[:84..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\merge.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2123
                                              Entropy (8bit):6.6055799166889635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D6C97AC010AEA0B2087961037BF1A756
                                              SHA1:D89B1C66427FC62964A929E6945C4B2A9F089EB5
                                              SHA-256:78F003F5EB7FE953A6419B53EF8E0E4E0632E08C0C2EC6392C3CF4EF95278D6C
                                              SHA-512:131D7F7F8711A231FF409DA0C3ACABA7B71693545D5F4E4792669D891EF5935EDF0AC546C3EF912A2892196EBD467E7F010B3CD78CED9C67656256E1B5E9E1EC
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:703621E3317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E4317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703621E1317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:703621E2317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(..[....PLTE......U|.l....tRNS...0J....IDATx....N.@.EQ....=.)M.g|..NaQ.H.+L.]..]..]..]..]..]..]..]...............

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\mp10-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4617
                                              Entropy (8bit):7.450162806188498
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4CCD590F92CF69B5673130C25AAC6599
                                              SHA1:50856DC75193C93636F8C2F414A6D503B4FF5DE2
                                              SHA-256:0C74B9517F6DBDA3B81D78AF2C092A82BEFD69EE11B36A08421115EBED5BEA41
                                              SHA-512:E07FE580EF41EACCCC11C76EF75245B0A1CC7BA3EABCA8CD28BF15372C28DE0450BA7D5E830AAF9C1F277E97DDA2ABCEF7403D8C4A01720ED8E0902ACBA7E7B4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....m.G...I.{..1.X.to..+....J.ZW....+.\A.{..*..\...p.A1..Z..w..`A_."...x^.;.=>>..`.w..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A.........t.@...A..A......t.@..@...A......t..t..P.p......<...8....`....6...z.<.w.....G|.o........}<...wA.".U<N...Q...2......<...x.t6......a.p*...b~.o~u&...]<.V..o1O...g...}..\.......`j..j~D....cn..0......wo..s.....AOj/..I{.LZ.W....../...3z/|.^....B....J/2..........2.{..d..@K..c........}jG..Ko...v.?....O....V...yQ..g..:.s.2..LZ.-..W.\.Q...X...x..... ...^..5....K=...<......._..{.A...^.v...S .}.:.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A.....)`hggg.xs.....C<n..Z..+g.@.9./....~....*..t.).u...3. ...._....O.....}...v...g.....x.i.......V.J..Ag...)..8......kW....A.._.x.W.m&...:....1<.....gTS..Fn.^.7-.w1P...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\mp10.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4722
                                              Entropy (8bit):7.533474283364141
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:91E26618457141BDCF8EE03C3F6E8F4E
                                              SHA1:C316302C97BBA27FD858D4CA546B8FB2AC5D8772
                                              SHA-256:38FEE150E1322E1BA7003D12C2058B7FFC15854DB8FA0F48DACDCE492ED7CDEA
                                              SHA-512:A636CDBED9FF97ADCC104915D576A5305CDDC84C5F5EC8D49B14B5ABC50D858E4C222264429635D61ADD17D9CCA623FD40927FBE3D984F98318BA9B9AA57DE8E
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....$IDATx....q......-.......,G`..".C...,G...8.K. E`.@..[c..B.cf.u.>kU....Q.S....../....?^?.h...@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@.......E..AD.G...+...wZ.......t;..|......0".G...}.......".X.7#.w[..("..z...8..W..;....F.'........D..o.m..{.........E..:[.A.Y.....`...U.HY.q..Wb.....}..7....ZuUn...=.......X.q....2~.^.#........X&.....}u......a...G.g.G.........,...z..@*.......y....x..~q\.A.h. ..O.z\.:._pW...../....~..<.d.....x.....\..<!...AY..x.............L.t.;....o..o.D..&u<...v..c...#....;.}.^.~..s..$......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ ......@......:.$ .....^D.......I..eD..C9-..lH..*..........7..F.ID|.*.....=)Q.......f..?".SD<.J..M.......?....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\newtab-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2827
                                              Entropy (8bit):6.547374900797109
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:05438F588D5CE5BFBD000C1B7050AFAC
                                              SHA1:49775FF95130D7DAC71A8AFFE6663A9384500DE2
                                              SHA-256:235C89CC0794F1A6A3260C9807BF00052A77B9116F61055BD6C39C2CCDF0AFCD
                                              SHA-512:79F4E7E3713E50550EBE532D0282999630EBEE542CD6669D547F909DFFBE2E4077206D1E8F3157A7A9E77C2E9E9783190DD861B0962BCB539AB98AF6E82F0BBA
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...n#U..a...@.o..{.M...P.Qb..X.D.))......./.....M...Q&......`w.fm....#.....|..r.?9Y,.-. o.....:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:..sm#X...3..0/.rn..>.,..Sx;....^.....z.D.F....b...uj.<.uD....A.}..c..9.......d...>.@.w{:......O``....S.O.o.......D....:..._,.4N...juM......'..8..~.../g.th..#X+.......4..g.^.c........C...`..wb..0...M./.1.\...5tx..y<!...B.y..~5.A.F.......}m....xl|i....4.b.r..|=..6..y.};'1O.T..i..w.u:.^;.-.,....}....*.6.K.`K\r..A.x.........opk.,qo....0.........>l..\../#.t /=Q.A..?...Q...l...&E}.R....1..U..5...X_...:....[.J]...t.b.....r..V..8..O[.{...)..1.t...A.@..t...A.@....1G...s...Lb....:.y..c;?.....q....... ..:.b.......:.b... ..:.b.......:.b... ..:.b.......:.b... ..:.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\newtab.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3424
                                              Entropy (8bit):6.84655146431663
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:92497713EF2E88BC345634F4EA5DDAFA
                                              SHA1:0D8CC2589AB3E3491970B158D481D0B3DC0741CE
                                              SHA-256:8BCBB89FC1B159184ACAB2BB1E254925062E6DA66B2379FAB7FB6BBB872EB072
                                              SHA-512:4C9F77FF4DB0CF31650D190B9CA0D97E53992F73A46E66420B81B7B147297A737CEA1DF8231E7F12D8147AF469819CA1BDF5E00CCD084BF7EF603A3D6F425E6D
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx...?o\Y...."..H.7.6.H...C.*J,..6+..2A.tl....iiPh..W...t$.:.Y..o.....9.{.G......+..?s....u..}.......:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. ...@.. ...@.A............:...t.. .....&..Q.k.=.......C...IU}.....?......8.O...........O[Y..zVU..8.A...tV%.,E....w^U...,...t..8.O..8.s..... .7<....,p..~.a.. .g2...t...{.@..N..v.;..g.....OU......L..t......YGkf.?...../U...2...:..7.;.iU.../;X+.....yU}..q.......A.w!.......lF.a?^.:.l.......r8?.._..|...{>....y...u.h2......f..x9.....|.....>7...}w....[.R'X.K...@.cr{.."..1.....`.7.3........o..O.c{....._..O..<.u...-.....n.v|..h......%...3.X..Uc..}U...u0.t.5.~K]...=...\~.m....9N..\{.~.<...}.....].....:b..A..c.3.....C...mb.)A..-1..P{...L.0...}

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\notepad-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4237
                                              Entropy (8bit):7.191413148938055
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1EA6667A2C4F5861E55F92FFA406A623
                                              SHA1:3C09D49CB6EFCA8992EC5BAEC6F6CA52E4F0F45F
                                              SHA-256:562D11849CBA229DFFF7A8722FF9E88DB3084DD784107C39443375DD18E9014C
                                              SHA-512:298DCBABEF824F3C4E2AB264AC9040086F6CD8EEB758FCC0E0A157CA7BB27BEB97538C038B292E8BAF0823C2839297F5C85BF0A6E4D33D9EF855C2A7FE2A5775
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<.../IDATx....m....a.....NP...... ..u&H2A...L.w.H...........P.F.?.EI.=|..P.F....O...'.....b............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. ..........:..:. .............:. .............:. .. ..........:..:. ......?rf..f:.........V.i[...r.`...d.^..%..]z.2..,..e...Q.:.9.w-.....Mz..$...ON...7.Q...z5J.1.:.su.O..M.z....:.3.W&..11.A.1..t.s.AG...t..@.A......@..s.:p.5"..>m/M...?O....:..........d...S.D.9......:.9..#...:b...#....b. .9..... .....S..tb..6moM.@.....rym...... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .9..#.b. .9..... .b.......9..#...:b........:b....... .9..>....s.A'v.s._.9...;.....A.s1..t...AG...t1.s.>;3.1.......E..m......>m.-..ygb....9.....W?...v.I.Y..7i_.5A......o.._...../..........\..D.p..d..|....1...s.t1.s.s..1...AG.A.A..\.A.A..\.A..t...s..1.1.A..}.....A'v.....M...A'v......t!d.o....]....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\notepad.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4199
                                              Entropy (8bit):7.266448890728401
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:90B61BCA72DDF8F90952A3BFF7F80CB2
                                              SHA1:55E9EFF329711FD6A5307B554C78B20A613E9D65
                                              SHA-256:6CEEDB94D6D815D9AFB965186CB01788B151484479954D20D99CDCDA9AE2F5FB
                                              SHA-512:F9E584B90C34C36FE4865BCB7E04765E591F2C9D84AE0D0B7058B0A07273FD32D07B682CFFE61692FC9D03D34CD3E234E02461ED5C04D55A7800C8E16CAA0AF2
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.V..a0..f..+.]..."U`...+.S.n*.R......L..V.t..{7.D..........X_..^^H..................................................................................................................................(......v.H....g&.{Y..1m..L&...t.;....$.....).wF!. .....:.....O..VW.o.~.........@..i.1.A.S.....I@.~1..p.!...$...|b.V. ....b. .9......:.9......:b......1_..)3.....t.^.o&......d..-...s...1..t.s.AG...t...AG......@..s...1.@..p.7.. ...].~3Y.A'p.'.....:b...#......9..#...:b...#......9..#...:b...#......9..#...:b...#......9..#...:b........:b....... .9....b. ....:b...#.....b.I.....1.!.(...N..9....b. .9..... .b.........8.~<K..i{..E....U.i{L..A.1..v`_.._.....<.w.~..._.._4..M.<.r.2...o.....?..|~...3..S.b.t...qI.y......s..1.A.s1.1G..s@..t.....]......].....AG..1G..s.s.t1?.R.A..tb.<....dA..tb..<..7..!c~W.. .b>.?.."z......:...V..;.U...:...@..t.....=.....}..1.8.....9...b.a....9...c........\..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftodoc-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):11916
                                              Entropy (8bit):7.947717771727305
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:A28F8B9CB119891ECC9891F8F7CD0737
                                              SHA1:BF28E0F2962D926641C83CC3E97C248E271D8D1E
                                              SHA-256:A767C5C59A8A4A6FFCFE6D8C32E8DC1C23E44662484D2B69E3E846DAB6D4BE91
                                              SHA-512:BB221F35CA1149FE047AE353057EC305CAAF8A0BDB59F8FE3F39BC217F111302B4CCC224FDDFEFA1DE7A27C2E253C711C6F78B8764C7BB42B48EB6B673D5B913
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}.......g.....a.A.TD.T...(.(q}.31..h|..#Y.&n..1..q......h..(.. .0.0..=.=.T.....@..z.k.....w......w.s..J.......`C.........a........a........a........@X..d..Vz.+W..o...q.~.,STQ.*+.&....(/.M.r....Q<.n.!I...w<T....hXq..$.Uh...4k.,4D&..%K.;...W.2.....G..7*7..r8j.......6l...o.{$.ri3Q..Bt.g..2....r..bu.v..n.8.....{BU.VpNr@.+..E..4|D...7.Y...............,*.['N.....z.E"n5.E...E.S.Htu...a.UU=wY..h...%ptI....saV.%j8..4...R0.}.....(.:.....*@F..a....3f.....Y.....]j+......y..N..Z.V....$.K.5x.v...7......&.....Ko,......!...@......C..F".A../!..B!.t...;..]...2.$.8.raq.1q.m..t![.y ..P....$.Z.a.....~;.....6..<..]a..a.PT4..t........j.Fi..{.}CG.847.q.@z.V..C7..s..2..%I..'...6.5.....a..8}...IxLIIn]v...,....v..KZ.'-OP.soem.Oh....}-h@ ......s...0.-..D.V..u.f.U~..Csrk.*@.),UQ.*.J..2.."...E.B.z.]e#V<..~.....0..Ga.....Ki...9b....U,..z.h. ..+.].~......`.y....P5|6Z.H...z.A..&.d.K..p8..........-

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftodoc-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2906
                                              Entropy (8bit):6.7619107967414935
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14E443A566A9334395E89462683C5C16
                                              SHA1:BC7E5CE48AB59B00CF446F4FC82F6229985BFA7F
                                              SHA-256:78C018A87F3173C63D68E38EC684F987ECC73BF638662F26467A686EBBAB6762
                                              SHA-512:EB88E9CE6B6FA2A1920FEF9A20D980235F895E1DBA2532EFB8F6CDFBFD96D191B27547292CA54DFAAF6BE1052CECDDE3C9F5CFF51D69F0DC410CD31809004E99
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]n......1$.?....,EQ.c0P.g...7.>P..6n..m.>...>]...t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.......t.@...A..A......t...9..\.es..[.ur...3m[.^.....8.B......3t1..=.(.t....PdBG..H.t....`BG.....5. . ....._..2.....[..A.....<r... .sD.@.A....D.@..u.A.Q..t.u.A.Q..tD..AG....D.@.A....D.@..u.A....L...... .:......:.:......:.. . ...... . .......:.:......:.:......).@.A....\.u.D.@.A....D..t8E.....:.:......).@.]........:.u....:@..K..i.m.A.h....T.;..:. .............:. .............:. .. ..........:..:. .............7..9,.....u.\%.A'i......'.......@...sQ..t.@.2.. .8.......p.%....t@.)t/.}?...1.}.t.q..M_..t.F.....o..`..=.........M.._.1.....#...>.........kG........P ......s..d3.D]..@

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftodoc-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12675
                                              Entropy (8bit):7.95791158923746
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:02B6FFE8E870C6860F4720FDE730EB2F
                                              SHA1:D888FF7DD7D7989B267B4CFDB7EE5D207FA473C1
                                              SHA-256:E21B73A67CFC31AC76D52D024CF92D53E472BB36E77613D14D7340203F559FBC
                                              SHA-512:7776878A9B43E048E24BDA60618B35DB537EBB351DBF13B6C5EBB1588E73F8089BDCE4B81BB60F82B6B924913AF9419145CAB124A8DAB0A089EEF9FFBCE13A39
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...0bIDATx...y....?.Ou....... .(.F1hb.5.....#A...h.I...4Q.&!O.Eb...g 1..h4....(7.......;ww...9wf.g{.o./.Lw.t.|...[..!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!....b.i....T.q&I..b.Bti..8x..k/...".8..Tft..........y..n.....!$M..O>._x........`95.>YBsS.6l.....mc.|.F...RwT..G.x.t.......u...d.--.X.y7..I7_...y.^..EH).z.A..:....]..q%\.@..!Jzc.....'....y.wt.XS......X..!..s>\...UT.cP|^.[..p..XC......."..t.,.f.i..n....J.....uP....`.5.u..G.....n6......[B.......N....[._...:.}4....RJ$.......BX,.....$-M..N':.....E.....$.+..R....{O@08..R.. ;......x.......F...R..%.#..x..m.VV.+'.d...`.b.mw....O_mte.bv..e5...X.t.N! Y,.6.s....L..G....%..........0Y..Vi.=.=...w....bV..Ep.Vt[.Q.I..2...q..v~..4J0%.....A.$.L.....jc.Je.%..R z..5.O..u=...G.~t.v.-.....'4..v.1.=....[.)....o>o.e.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftodoc.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2999
                                              Entropy (8bit):7.2994051743491895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6FA4D7C0C1335D55156AF1FBB84709F1
                                              SHA1:AEC6AA50716F2FA208E2526604B70287B97E589D
                                              SHA-256:5EDBCD089820380001E2872804B68412069B49DD69544E32F30244F12F0BAFC6
                                              SHA-512:EFEBCE5D8AC72DF1A1F21704973D51E60B3F93B377673365AD24B3C9457ED02CE25EBFE0571A20062CE77F99B2619B41CB208F7E24F91E5BC48277214CF06ECF
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:4A9C9431317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:4A9C9432317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A9C942F317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:4A9C9430317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.18 ....PLTE......U|.l....tRNS...0J....IDATx.....6.@.....l...#..$...3@y...G.\a.@.tA.tA.tA.tA.tA.tA.tA.tA........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoexcel-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10938
                                              Entropy (8bit):7.947678849883698
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:69614F8D1AAAFD9C1D2FAACA18C5F169
                                              SHA1:53E8BBACD98D09008A9A9FB6D7335FA3294623A3
                                              SHA-256:ED61FC4BDED1AA8042FDEB4CF85E172AF9992F0662E3DF9B4FE0F5FFBDE00E1F
                                              SHA-512:3D3711F8DFCACB3FEF45D84E187869EE998FDC530A50EF97120367C1A5C0CF8BB3C5918D98F1DD525FF98B5F80D7B8B40D8F87D3CC72C80D674A9066BCCCBC62
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<..*\IDATx...`T..;..m.......D..q)}..K.*P.ZiAmAk..g....}...Z...h]Pk.P@Pv.K.L2.].9w....If.g......;g.....w.4M#......................,...`.. X.......... 3..t.o..6...[......).EU....4.. wjqq...p...V\h.."I.......y_]4.:-V.P+4j.(.>}:*"....^.E........I?..:.hv..d..@.'.......m...4.#..R.N?.t.V....YN.........TW..a...YU...L.`E...._|....~.o..K...3.Z.^/.F...8.?......{...Q$..Q.j*<....7....7.._.i..7.oG.......B.+'.......hM..%.........v.......5..^.:..<..be..e.}em..W..k}eKK.s.n.].......LkpY.tku..y..e..IQ.pE...y}_.m..l.d....K...wjy..Z$..4.....`.s........B.@..<..y....obn.........F.n.I..1...d..ws.....z........d.ur~....~..J0Ac.....6..w.W.sLv..JAz.V..E..:j6).:...E..n:.Z\...o....}...%<..0...=ES....8.)..E.b...hg.Y:$.r.2s............,.......+!M%KH>.........Z.igai.:L...,SZXd.]..xR...F..g..g..... },,F1.,.,.0.9.....S...~.NA..t.,7.,.D.G$.....|/..;.,..H......p.M.6.Q....a.L..i.D-....Q.@t.....%Qs$

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoexcel-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2958
                                              Entropy (8bit):6.786038165465153
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D8A57C61C2F16D7862C247410CD728A2
                                              SHA1:9E676C0A3717C3408079B17111092FC6445C593C
                                              SHA-256:264A075AF3BCC54B10DE9CE4A44D4D9CE76A59FFEF20A9E7969EAEA56143C781
                                              SHA-512:9242A16CDA99162B7C3BD56B35D335AB5BBA878C521E5DE17F71039278C015F3D34B65418983A69F1115456BB119DD276382E86BFAA8D1B5482C8A4EB785E20B
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...0IDATx...kn.8.......hO*\ h..i.Q.}...i.H*S.x..<.}......%..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..Aw..@...A......t..t.@...A...Y.........m{....y.{.^.....8.B......5t1..c.P<.6zQ.......8.6wQ..........k.@.A...X2~.>.\3..?..h.t.=.|.S.....t....:.:......:.. . ...... . ...... .:......:.:......:.. .....).@.A....Q..t.u.A.Q..t.u.AG....D.@.A....D.@.A..A.Q..t.u.A.Q..t..t0...:.:....m.Q..t.u.A.Q.............. ....cJ..t..+..l...i..A......0{Z..6..S4.Wr..*.;..:. .............:. .............:. .. ..........:..:. ...... .u]..~}......'.....v..<..0....... ....E..Aw..@..d.....tL...:..:1..9._.e.2..dx.tlT.. .c)..y...s<...0o..:....A..o..E^s.........\..@....<e.6u<......:.t.Q..O.s.....{.v....clB.g...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoexcel-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12246
                                              Entropy (8bit):7.954387380862615
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F3DA6186C7B45CDEF09210B98E97577F
                                              SHA1:687530E9BA259A4ED48B2D346F2063CD688F8C76
                                              SHA-256:926EBE6CA1C9EAF1B77240617668FEA27C871994F86F177EFABE6CE6B42A9A11
                                              SHA-512:72E5B01B32E1764B1BC1CCE7B46D9BA14073DEB74A17D7B9395365A8E0ADD5B70D5B8811E22FDCB47482FA2E821EBF05E636AD6362BB6FD36707AB9F5EF4B1A6
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM.....IDATx...y......[U}... ... ..Y....hTD.Q. x.]b.f...h4.0j.....j4n.5.u.Dn.....000...U...5gOwO.tuWO....tw......[...[.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!...%.f.(....(.T&...b.B4q...>..._0..=........p...MG...J.=..G.5.8..8....o..dI.%......9......m.....o......1.H....k....S^........s.*......5c.=@s3F^?..Xz..."$....c.....G?zwJ..p..A.zV9.1A.PX../....7/~ZmnNj........r.IK.....C!..U.c...q`.[.{....9r.._?..."$......~p.....`.96Z....<b.N..C.7./W.....:t.u..Z..IH.i.$.}......U|R........Yk=..nty..%..lz..>...,.>f.U[..&.D...US6_....u.:..F$$W..pBa.q..T..Z.B.D.....Q......w~dty.....p...-c6...]q...y.Ct....J..r._...b..I...aY.....-^....,.p....{....o2.A.1..E...8#L...U.y.....q...]tB.m...K....ZL. ..`.+...._.S(....I..iM0].....K.5.J}K(....h...T>.......P..o/W.._.._v.u.....C..h.....z

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoexcel.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2942
                                              Entropy (8bit):7.307787462443382
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C4D08B29E89A3C1C2B86B2A6FF706EFC
                                              SHA1:DA37A9126FF77D816C8CE5B2A42FD86521BDB5D0
                                              SHA-256:005F9379263FC087C716BB4CC3C18A7BF868C5F29398AC3DFEDED4C96C9AEC1A
                                              SHA-512:12EE608A325E14FD7DAEF811593C40C6008064CFF8494F85BFA50B82B0C87E7E43F8EF8F82FB92DC4541AF304763B926F47211FEC3128859CAC364D6DD9D9064
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEAE317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEAF317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEAC317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEAD317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J....IDATx...[b.8.@...7=.3.8..B...{..*.A`.h*W8...]..]..]..]..]..]..]..]..........

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoppt-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8333
                                              Entropy (8bit):7.919833170548455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3EC29494B323722DA19CB770D59538F0
                                              SHA1:A5612F6B2F7F9C78285D1459A9F9B1328F399311
                                              SHA-256:6430AB49A99D33F6E8FB35FA8BF33ED69D0AC982BCA3FD215DC1FD67D252483D
                                              SHA-512:F7E06AC5183CC9D41E05BFDC431895F193CCC732E4368B21AEBC2A61374D87DF231709C8D555D825ABBFDB89D02C2B2D6A3509509FA8A2E6769B50C8C23C0529
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.. /IDATx.........=......,,...@...B..'...g..?.x.c..x?...%.W.1*.y.#..!...%*....\.bgwfg..z.=...0...Vu....C.1[SU.....Za......&..@........`....... X......@.........>.*...+.........I.eQ.p..)/.vlEE5Y.w....%... .B...6o.w.....F.Z.F..M..~:....../......+y9.W.)gVW.`xq.T.....;.M..O.Qj.gG?..;w'Q+..h...,..V.;.v..../...8.....~...U.S.d..V:..#.*.L.8..U5.f.X.......F16.*X.1.....;.....w-..A....H..K.$Z.So...9cl....:...9.G..sS.<X....R).. ..(.H...G..,.f..X..Z.xZ...*..{.........}......!..}........+..".t.).5.4.n.;...2......p.f.+..y...g.T.......9.~..g.4zPt.......1jd..C/.h..DB{.U.O........NK........CQ..O..)...;...[?..@<.nwX.\....M.... V......].c|....7..1.%.W..-X.....1..2M.v)E.(.'.C..E.T....nx...7...G..ht.3M..h..K.O..h..l...!e....7....u.kr.^.)...!.J.xI2..q........A...9,fY.Y.L....aQ....'..i6nQ.A+..7.q....`...8..2w9...9.a......+..MC..7.V.].>.W$k...9..g...8...\..iO.D$..o:.\.5.R...%Vo.b./.B.....p..R.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoppt-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2776
                                              Entropy (8bit):6.7058519419579525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED025911C2A797BFFB0EE3BF639DD16D
                                              SHA1:4188FFEE825572BAE142A1AA37E6E2647CEE9D24
                                              SHA-256:C0A832E7AB49F640CA05A2D9FF26A748C63CF8749928418CAA8082751A00C472
                                              SHA-512:3D03B883F534F4CB38BCFDB4583702FBFA7136271113ACF4C678C54F2DDFFA342D133688D9C136F98AB2531F34D13157989D604366CB33271F06F4908F2B8C04
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...zIDATx...mn.J..Q..$....'.H !.!...t.u.O.W\..O.....?...~... ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .............:. .. ..........:..:. .............:. .............:. .. ..........:..:. .............:. .............:. .. .....:. .............:. ..._......nS}c..U.8..s.R.E...A.rQ..yS}.].....A..:.!.:..@...E...:.. .6t...A.Q...Z./..Q....-@......s^..5......Q..t.u.A.Q..tD.@.A....D.@.A....Q.@..u.A.Q..t.u.A.Q..tD.@...A.S:......:.. . ...... . .......:.:......:.:......... . ...... .. .`J..t.u.A..1."...... . ..!*.v.u@.A......tL.....pf.}..@.1.. ....X]......tB#.&.. .W.. ..........:..:. .............:. .............:. .. ..........:..[]..m....c....@..F...#..x.^4...~....b....zH..@.....t.@.1].p..[........-th.r1w/...T..*..&9D]...;..-n.,.....&..6x.sA..Q...|,.l.......:.t.Q..~u...M....?.......@.....uA.. ..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoppt-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10530
                                              Entropy (8bit):7.947598541287712
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C29C5BFB25E1DFAFC833AB17699A6789
                                              SHA1:16D77B4EBBEA7CDCDFDEA5FF7DFA4C428BFEF745
                                              SHA-256:D7AC281F639501781268BFFDA1FBA9E21DBC2F0130825031DD2CD394AD871361
                                              SHA-512:284D6DC55293B53B16C917D6E2DB6E4A50E6D0EF5EFA31C5D9601453FAC2D510A6F579242D0D3EE68B76C977E823287BA85A0A22F693D7580077E6A628FB651B
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...(.IDATx...wx..?..m.d.....L.6.......B(.......p...PrC.1...@.!`..KI @...b.el.m.-.$K...j.;3...h.U;....~.g..vf..Y.:.3........................................................................................Q9..>..o..\}.q.B./@..N.........Y..mw=..N..CT.T?8s..?.8..V}.zu%.t.....\....^..(`j3..t...Y....'_{.....!.:.0T....b....l.v.~...7\.n...N...\)...cG.....<.~..!Y....(Lhq.._......#...Q.R...}..~.....{tw3P......hm.C*....+k.24u.G..uN.......C|.=...W^.aT0XY..`.0Z..P..&....WQyQT...]..N............E.3.q..T2D.DC.P...p\...r..{y}.fl..{..IT.T.x....W..]...u.G..;..hm...-...R....9.P...c.?..+Q9.......C^.~.4..Oi.....$..z..z+o....vl..=...HT@...x<.L.f9.Z.#%.a...4.Uo..c....p..+...N......RV2T.]..c.hS.......w.<Dn...V.....D6...@.4.9.{.{....B..9].Dn.8*...?3....W7...n..V.0...f}..fJt.Q..^........9...&r.%.C.`:$.x.uU._..v.%N...-...<Z....=1.Dt....=.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\pdftoppt.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2814
                                              Entropy (8bit):7.2132718842531665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E3512B058ECD37D273426DB439743DF9
                                              SHA1:BCFC08231D94918F4DC21320385F61920088D522
                                              SHA-256:5FA66590FAC4AE7DACD6A1E622A2FD0749F0DC38B7E28EC2596ADD84AC31B337
                                              SHA-512:2F33AC0B3CB39C8C6BFFCFD3C77BCED04DE96210C688083E72299F00CC86E9CD886B1293F635829CBB717747A6B84214528A34920F7CDE218DB4BB32052D91C8
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB2317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:5F95DEB3317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB0317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB1317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE......U|.l....tRNS...0J...OIDATx...K..8.@.../=.)......o...ASF2&.....tA.tA.tA.tA.tA.tA.tA.tA.t.......

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\ppttopdf-ico.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8843
                                              Entropy (8bit):7.925453798643038
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7FD8701AA8934C93B3B0F4771D8E88AA
                                              SHA1:B799B4F17323D8CB29C306D71131DA32B1C35E3D
                                              SHA-256:C28F676A5E78F00A0892B851143AC217F3222A52658BCE5BBD3A911792FB5B12
                                              SHA-512:E0B754AA42411DB8BC2B3E5978B7E8463AE3D2696FB4E6778AD6856B39A62C0DA82131CF108D8B20B45753634E02F266CD77374EABD4D16A88DD7C85DEB96A76
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<.."-IDATx.........w6.jw.M(#....L.9.F.D8@.0 ..`Np....1 .$0....&.G4 !.D..<.e.d....yvbw.U....nO...~\.l..........].0....d@.... X......@.........,...... X........nY:..:.r.-.....^....D.A4..h\.5....@.....F..*.g....R...6.Q.[!E...\..={6UVVb0r.".9.D.B.....A........f.D3.>...*.O.../..o...6-..e:....AI.j.*jmm.@....TWW..`.<.._.Jg.x.]..........\.......a.....E}../7...{....y)I..>~9....,.....'.e,..Z.....4~..mW.....?.......r...`qn..&_0...^.....P.X...E{]./..\..FNxv....a.@n.....%M...z...Xi.+..3F.2....>{.q..^.....`..U]p2..;.ffluwG+~..tm.......>.w.....K.,x\Dw_Js.^..8.vG.gX{7.....x.4........`....!../M....mDaflj..{.....3.o..7....}b......,..TUN..t!%.....j)..Vw..^....8..]F....c.+....#.y...h...2.r..1b=...=.K.Z.Q...,]'..F...W2..9.a.h.4~.E\._...]G...2.....5D...}t.].V..>.%D+.o@..k.....8..q).+H..,V.*....G.c.d.......?1...:a.s..1....._.n.F.2gap...]..>..._..=.#..!X...p......&...e._x...c...,L.9`.}p."..3:v.....(.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\ppttopdf-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2757
                                              Entropy (8bit):6.618726290909534
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D04BA666E50BBCB5A108F9FD3F011FCE
                                              SHA1:3360483D369DE184ED3313955A40E2807BB67F40
                                              SHA-256:CFB777DDECFA0116237989E3A37949F7508FA9BD9C2ADA7FC153F370538E818D
                                              SHA-512:F650D8185E37CE0111707F820693E4D35A3502DA0443CA926C9B13071C99971BD25212320FDC0B8E8B7A5659868DBC8191A0802AF7E5EE1FD22D56049F845010
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...gIDATx...m..X..Q1.....9a.)...J.|.......[....j......w.......t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.......!..A....+...e.,M..N...=.m..N!.u...].E...<........A..:.!.:..@...E...:....A.....0.#...3w..z.93.?.{k.0@.m...5...~...x.M.....Q..t.u.A.Q..tD]....Q..t.u.A.Q..t.u.AG....D.@.A....D.@..@.... . ...... . .;..:......:.:......:.. . ...... . .......:.:.......t.A.Q....Y.u.u.A.Q..t.u.A...?v.u@.A......tL...:WF.l...i..A..0..!..i.G...Nh....H.#w..t.@...A.........t.@...A..A......t.@..@...A......t..t.@...A.........t.@...A..A......t.@..`(.C.t.,..(.....(....E....G.:.7@..bN.u./.:/n.."..Q.._...Ed.D.A..v.7o......XsA......>..\T.........#.. ...s..<.J.M....e{...w.=.....u..!-...>.F.........b.D].I.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\ppttopdf-win11.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10271
                                              Entropy (8bit):7.928721599372092
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B615F4DA93488108F48CBDB6B6DF614
                                              SHA1:7D77EF71E3ECAFA6B69384ADD5F1F8A973FB2253
                                              SHA-256:7B05F7B8DB68E5D8EABC1DC92DB8E79BE3E1A7C07B593CC9E58529E8C2C309EB
                                              SHA-512:B2209AB5E50A9CE8C80C165707F356F8FACFBB1734670EF681BED80BDFF4B2D5760D48C60F2BB5AD13C92D219859B18DCEBF4192FB4575B2CF2DB8B118BEE997
                                              Malicious:false
                                              Preview:.PNG........IHDR...,...,.....y}.u....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......tIME......3.MM...&.IDATx...y...7....ev....."..@"n.D...hp.D........&1..1Q.....%.c...u.%..4.j.F..( .l...U.y....u......y.zX...t.._.s.wN.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy..<YJ]u..E#...Bh....%m.:.....O.*N...d..r..E....j.......u.8D.&`.q..]>.?..B=..L.....|........#....O.....D4.....?.......=.....d.V..d.P..&.[....)0.~.....o8]aD.Y..5...W.....,...U5H..h.`.g~.u.I..ckE....q.lD.U....mX8.p\ [....z.,..1..P..u.$e.?...n..p..D.....S..'.{..@6.7...S[BbB.....B.........Kt..k....CH.#..>Z..uA.)...^z.x....$.L..x....9|.NF....7mI...Dm.v./O./.^...t%.....L.....6L.c.[6.../. .K.......^v.!.qNW$.`...4Q'M8.%...7%|R....K....te.y]......T..ZZQ:.+.'/>...N.....?..E1..r>L..Qh..._......N......:..r.%...]bf]`...../.+.....tPp....Q..c.W?ta...V...+..K.Awnv.,..%&../\0+...r&...].BD,..q..a....~..ze...L...X..X=.L.....k..`..5M..]...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\ppttopdf.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit colormap, non-interlaced
                                              Category:dropped
                                              Size (bytes):2803
                                              Entropy (8bit):7.185935021853378
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:101ED9DB0B4793A59C88AEFD8E0062CE
                                              SHA1:1FEF663061DE3109B33CA304D59593A4B3964112
                                              SHA-256:AB62C666CBEE2E05F7BC560ECCD6B78DB4F78A28F85AB6F0E7B2C8BB0B43FABD
                                              SHA-512:AF0FC84C31C5DC2CC36804F1CB37D18FD0D7F59A9EF3BB392AB47178BEB8113A6B9C6F31EF9F7F59509E9118650853090A1CC57A73CF3C199239E2197A7BA94E
                                              Malicious:false
                                              Preview:.PNG........IHDR.............../.....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:5F95DEB6317F11EBA6F7BE6BE6B697E4" xmpMM:DocumentID="xmp.did:703621E0317F11EBA6F7BE6BE6B697E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F95DEB4317F11EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:5F95DEB5317F11EBA6F7BE6BE6B697E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..z.....PLTE......U|.l....tRNS...0J...DIDATx......&.@....:UY........u<.8/~.Br4.+L.tA.tA.tA.tA.tA.tA.tA.tA.t.....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\print-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3710
                                              Entropy (8bit):7.725953353749253
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F97B6AE10023A466BE864C4C1E60A719
                                              SHA1:B63879B947757C229599278144828DED4FF7E14D
                                              SHA-256:08B020D6AE4418386360819159D81A8930D458D79054F8889FD918E03905CCA8
                                              SHA-512:887829E6B59E89B69F3545EC1F96D22F6CF4BD7C6418DDF3B07D8E5275E954A375C68030E182E31DE549807296ACB2EA7EE9FF73849746CD4E62887DD4BC4EB6
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....0IDATx....Q......-.....8....F`n..........`!...."XO..@W.......I....}..j..bD.../..<==9.6.....E......ao.....C..a.?...o.w..g.m.....s..^.{...0...-D.....\S...no.......W......1..".n....U.......Y......o-.FT.@..?w.}..rP.........Om...s...\.t...i..*.@D..s.3.......@......@.?...Z.3....m.2....#..x..5|w.....1....S..Z.dm+....d.:}\,....u]..=m..&..9....S.b.......9....-..}.Y.).........}SS.$..(..".}.l....z.].N.k.M{..T.h...QS...w...4...............D.CU...$......Ty..7....B.8.M..<......G..nq...."M..*@.'z......T|....T...N.}.)...............b.@!..6..z..........M...>@O.........Y..`...M....S..q}7...w.z.T..........6....2?........U........*~.G._.........Xe.*.........1....."......1 .`....z..........).b......"..`..k....le.......c_....,...z.?Q..C......e)...@.......l...".~b..L...'..A...@@......Xf..!.R.e3....4.@........o3..5D.p...[.........,.*.....4=..Fy0.....t}..X.......".p.&...g.....'.4..U.8RS/....(S.,.....q^......lnT{.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\recycle-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4850
                                              Entropy (8bit):7.7990770760739165
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:48B196E62CE46E1BC263E51BF6283348
                                              SHA1:AECA28FE16CFCB80EE1775B4ABACB02968C25139
                                              SHA-256:E2CA9CCE941CF0B62EBB51B51EBF6501BF2D2058F3F1DCBB82A56CD1C5469F73
                                              SHA-512:6EB6EF86BF14E8DB3C11362B74E43CE499D7D30CB1C60589FF8CCFEFA01FB8F18B4BE6FFAE8056502E59080014549C78BDD1B20D08EA196D9D2F6FB4711748C3
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~.....IDATx...q.7...+.........@t..#.*.Q....T.ZE.e.^Fp.....e2.]A.=-.........e.,.gv..~....o.....x....+.^........b..!Lk.<{..P...3.......[.\4....}0.....;.F....Qe.?w..sW!.{...O....{.].K......!....=0...._..m..F4......m.......G..m..5J....`....-..jpO..,<.....`.Y...].m<.....v...... ..c<.2..X........g..g.....%...=....? 3..B.Q...~5o%..2B.....7..._........$....L..dFv...z..y.B...k.. ?.p..3...@F..../ .x.yag..>....d... ...CK.|....$.&...>>;..D.?..H..@.....,4...'Hl"/ 1...b...B...8...B8.:.M....$.. 1.v..Yp...d8j.7..$.. =)v...X..H..x....HHO..2...r<./ .x.i.f....=..$.. ..v.y....Cn./........./..... .....\.../.>x.iH.S....`.<.ed..Sn.Q.../.6x.....Ys><^.a...I..W.......@......u.......6.+...!...\..7...b.x/.....f.n....H...zf..A..T..t8....jCU........b.4........PU.......d.hh TE.x..r.P........H....P...*kH.*s.....5.a.zJ...HQ.@>6@Y....a..'#.@.0...39.....9~.....1........G.2.Z{*.@F8.........x./T....*.........(..o.T*.@.>..^k..H..h.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\recycle.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4978
                                              Entropy (8bit):7.737470104654665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B0E2B9A6DA4E005D716AC7F3B44E510
                                              SHA1:05A4DFA57DFCF3F9E3C9517E6C455EF70C7F4758
                                              SHA-256:8655B6ABDBB8647B8655079B4B95C9E823E6A2F5F0B1CE51B55EE0E692E4EA52
                                              SHA-512:AB57077A09197E6E7539AF5E7FA66AC18A5EBE633D9407C64496DEB69D238BDD222CD5E4727FDDBE9DE150829E966458409DF1C4042A4CB75D930837B8BB67A2
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....$IDATx...U.....}.?.....#.G...l..#0..r...V........`...{.l....TwWu..9..1.h4]]ou}.zxx ..O..w.....{;.._.......k.7?.."...~(.'..H............-.....`.......c..GDtj.c\..e.a..^..`...;.....N2.#x..@.P.1..O.[....'.1.)....<..pp.............@ex.....Iq.N3 ....P.^....w..a....@%.v~.....Qp................@.b..Dt...<..`%..(.'.|w...3O..H.*.<..}........ ..z...8e...... 1....nC.0....P.....7s./.,.....3.........{./. .....7..... 3.w..K.7...BxU......'>..^@!..d&.......Hk..P.x...........H$9f..2.. #.v..n.h,..1....._..C2.. ...Jz..k...!L...$...... .1.....jn..........x.........=........ ..v.7..e......0.w......l..@....x.v.. .......;...r..V.f.x.9.....!2..)..d.lx.6....;.K.L... .v......)..9i...z..0.[..7....3.<.*.g.E...xN.F..."...[.jpODg\|5..........$....D........K....2.|....n.I.P.`./..j....j.....P....x..@)!.....;.L@..3.......(.P. ........m....{........S.`*P..;.@q......p*...;..."Q.(U....i....C....-....I....X...')..n&....>.h..,

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\search-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 179 x 178, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3030
                                              Entropy (8bit):7.889399998001199
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17B5698E0775CB60119ACAF854BFC658
                                              SHA1:A990A2F287D769F758A4382A6FDEA368DD3CE338
                                              SHA-256:17E0B003001B266557201E27C7E2A46541BFC476F71282A4E92F6E1668CD25E4
                                              SHA-512:8E84FB1CC8429D03D714FE247695DDD7C005E8DC9AC1DACBF490A482E4BB1EA4ACA6ED5708D775D7F0F9B5C0B94CDC525FE2125A7EE6D2D8966903E78C9F2D81
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H.V....tEXtSoftware.Adobe ImageReadyq.e<...xIDATx...q.H...L`....DG *.!...d....T.....=...G`:..d..`q...-.....t.*.wgj...........2Q.&x..n.[...}.....g....Y..a..}...S....2.e..i?_...........;fp.....vj.. .[.. ...s^..O..vq.....s..].)....(.Aqd.~..v.an!...O2.'.{........L..:...T.[..7..........l...q.0...#...N.f@...E..G....r.....>....A&...Ia.[7.?..l.)n.....j8z......H.7...C..f.l|.7.u.i........_.YTd..m[_..@.....V.....x......2..'9....@..#. ...s8.. ..d.V.."....@.K....t..Y.Z......s......\(5...u...1.^...av.2..].W+..c.{...T`v.2....3....5.Bx.......Q|XZ..N[.....z.t!.9..=..Yf...s...i..e.a.l....;c.jA......d.....(....(.........l.0...7{k.....x...._..D.../....z.R..P...<....M.0..Ln|o...>n.bd..G8.H.K....3.U_.....W......f..+.....k.I......Z....`.5{c.X..[S..4....J..y.y.....:d.:"r.+.F#G79......OOT.z.......>...._.'.....Q......@>.l...L.l2s.3_.d...Vr.k6..`..L..V.9......A....:. ...R...;..3W....[Ha.-..4.V...gI.....Lq.....~.e..a.9.RJWx.'..`Ah...8.L.>j.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\search.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\snipping-tool-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):4811
                                              Entropy (8bit):7.800226452755661
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5A7AAF46A68BE04BC25E1BE63B67F812
                                              SHA1:E0722F9410A5417B9629DE3C853DA92A442222A7
                                              SHA-256:43A3D08EAEE1F00492D42FD905142A2A5B421B8B72D24A3E55E58D68899172E1
                                              SHA-512:A66DFF512D0C142AC35C82A36D34465AE9D1FDF72F27F2954F341E9E587B6B5C32151F245E5AD7D08D0335B750BFB807441EAB8E0A7725D49E8C03E8FBEDCB35
                                              Malicious:false
                                              Preview:.PNG........IHDR.............\r.f....pHYs...........~....}IDATx....q...a.L.;3( N..V`..8.D. .."W......\A.."W.R...*..$....E./I.....n..*.%<.7^.....i...;...u.sk.1..\.c...C._....sn..j.Z.@...1f ?.......3.?.%.P}...Z....1.C.o....`.......Z_...cn.~..1f...)...Z...c.....SO........y....U.o..X.~&:.......?..#......v...P.d.?=....!..l.P..9B @n..t.-)...}.....L).........%...k..c..+..F.G..T..a.>\...........j.<......:V..R..q...tl?..1.g.M.N.(w8.r...i.....^./..*."....n.{V......(....[.?.....}~V.iZ..^...k.7{...~cQ.l.....@....r.... ......x...v.P..%...HV....z.....\.wIV."...l..e........ @... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#.....@... a...0..H...$....F...#......%.n>..1..\..9G..A. f.k..o..:...x9....1..E.bxc..Kc........./c.B...s..wS.G. vC)..%.....1.V...y[.?....ki...i......K./~...3.s..P..Z{-..H.|w..5}........f%...../..&....d.....]..s...4k.P..E....r..ZA@..S$....Z....Y..f.....P....... ...$.&5U..z.ZO..c..(H...H..we..i....A...H

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\snipping-tool.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):6318
                                              Entropy (8bit):7.6237297121206415
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C709D8C6ADBA0FDD3D44F142ECBF727A
                                              SHA1:E0766C40737D43B90F0DC89C8D0B3911D4835AA2
                                              SHA-256:1788E34952FF9E0C3075DE73353271E9D6EED3B2B26E04201875AABD5E98C6C8
                                              SHA-512:0128D69C893BFE1B4B561938840F2660A023257EB865CF511F637A2097EC5A941D4FE6E6038D5FCEE1543FAB0846168EC8E54C57DD4AD5F8F547003AECCEDC0C
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~....`IDATx....Q\G....-.gn....U...#.....q.B..E`..(...."X..e"....s=..kw...y.*J.o.5.......~...4....~.0|.....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@...q]L&..5_@ .....:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@......:.. ......@.......E..._|..7..K/.......wOOO^7.Ex....h......C...d2.[.S.......(...R........m..]......&...R...?....._..7#yh..C{..>I....y.X..M...*.t.g...........<..E..Y...HF..zHa..w(C.!.t).5W.G....uw.....S.O=.......;.t..4E....E0OQ.0j...:lg..r......M.{.a.A....h.*..=.._......:..8.."...vx.....4.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\speedtest-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8199
                                              Entropy (8bit):7.804883825542723
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A3316148C3C5232CB63CB357EE3E7BA
                                              SHA1:400400F3145F2C86D2C31AFAC0586FEFF88EF589
                                              SHA-256:81290539E0B1D6CC4FB79F9ADC0547121B2491A4CC98A2A8573CCCC48E00591D
                                              SHA-512:30C8C4E67EB465A317416F950AA05A35F0C259E45A5D4E108B0C16D43BD4BD7257D297E1E747CD857A8DA426C1054B024A0EB4A800FA8F9C13CC9777402D13C4
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx....q.G...k.@..DW..p..#0.....E.T..#.....o...LE.V....+......g...E.$..C...tO.......(.6...t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:. .......t.....@...:. ..@..........@...n...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............p.a.@7^.x..q...{.d~._.......P.n..........?...=......m.8=...V.........7...:....A...;..Yz....'......T....:d......6..2w.v..*?B~c..@...{.~~o....N.o.<.th;..;...'.Jo.m.>U...@...|.R}..C..M...<.t._..V./m........)....k..>..U.x#.A.3......*|:.S._..~ks.@..._V.....{..Z.<.t.8...:.q.;.t...)...8m...{..t.6.... .........>..3Z...-U........m.8.7;..6......4...=.{......\W.S._9#..pz5..H..v...W....~...c...g.....[g)

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\speedtest.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):8231
                                              Entropy (8bit):7.8363373988878635
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F5FD375C4310358421BB7A15D0AE964E
                                              SHA1:B969C63249AC6987D2F031424DD8B60B088E2D7C
                                              SHA-256:2A74597681C8BA212988BC151B2DF77728BB2A36D23984C9CDABD416866C7A0C
                                              SHA-512:1C45AEAFAD5EA215AEDB449EA46DE10F9831D748D8DBCA2FA927AE3586973A51A48A18E045423C1DB987004C84D7A21272CAF8AAE5B1397C6E904F36AAEE61DC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~.....IDATx....q....`:...T`.......L..*.T...^.......d.&*.XA................`.Ll....._..~......_....~.........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$ .. ......t.H@..@..........@....:.$.W.D.....l.............g.........K<..........W.....!......g..U..}+.o..]+..&|n...:<oWE/...U.l".oZA/.P..~......_{m..m....zs...z$..e+.w_.....}+.o.<.K.3..V..+...d...;..`8......,.V.~#.?.........U.....N........<.#.Z....tj.l..*|>n#.......tJ....~.........:....B....N..8].wf.L.3.E...9qz..Gs..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\splashed-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):10334
                                              Entropy (8bit):7.873906406263865
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B55A5A9D46B14132DF8F8C4EE392AC4E
                                              SHA1:B9B85D05AD637A83E984E90061EC0D5B03537D5C
                                              SHA-256:0C8AC55E33401713DE48B09B9643C8A92131D9F9BF0671D02F04F96F0462107A
                                              SHA-512:124063573D411FD3366314867E231FFAC2A5E598F5516208EE11702BC6633D9D6A439CAE8B4BE26100C80D64F22F2451E9B4A0C406EA0FC1DAB6698566688AAC
                                              Malicious:false
                                              Preview:.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<..(.IDATx....q.F.6`xk..4.@t..5.@..4.@T..E`*.."0....z..v..'F.....iJ"..@.......KHl..x....|....../M.........@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@...@...:. .............@...:..t.@......... .......t.@.......:. .......t.....@...:. ..@..........@......t.@.......:.P..k...g..._.o............|...|N.........<.../_..L/.....w...J..W7.~.>.......f...jy.>...t......m.... .a...>....i.S.G..jC~.I..@m..<.*.r.....u.#.>.;*.}./.w...6..*........V.,..T..t......x.....m...$.t`..|....[...I.@..V..m..t....pG...C<>/..p...B.....}.).. ......S....Pg..C......K..1R........:IAnz.9U.&U.;.@...|.~...L............-.....:.9....[g......#.<...V...[^.Io..uq....... :.:......S.......$..R...k_./o.....e.Y.v.:.......W}.7B.....udu.a..n..u........RE>.n..s.m.|2r..!.l..`G..w..Q..i....6.........^.#....;..1,.s3...7.r|<....].....[{...\.<*...K}h.zE......w.*..#.W...:...*.,U.g.X....F.^S..T..?.@G

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\icon\splashed.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):9975
                                              Entropy (8bit):7.872832845918455
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5E657E5A4F6657950F75DEAF4D4556CF
                                              SHA1:A4358BA3A0830BCF01EEB885EE13E5F3425E7E8F
                                              SHA-256:A775D1F1E8571E326B130FF0E9CF5F3A108E6444CB1A14F2C2222FD628FBF4A1
                                              SHA-512:B509FF6A40C9BD9A73CC00A57AD70A266D222BF3B7A6E2126422769274DE51C57838FCAE0F6DA73B80CAE2913A43C0CE760F1C85D28A55C55FB717C86272092A
                                              Malicious:false
                                              Preview:.PNG........IHDR....................pHYs...........~... .IDATx....Q.G........@(.....@8....#0..P......"0D`...F.o.]Oy@.0..3...<U.....0.y......o..P..y...|...* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* .......* ......&..6M......k....n..y..9......@"?|...k..Y...g7.?d..:.~.>.;....v .Lm.|.>...%.SiC............a.x.}knB.....~&..@..,;...x......7l.l.t..A'...{07!.U..L..x..o?.z.'...K.<...0.u......./,....tHk..qC..i..K...F.C.n.~...*...s.N).:.....G..,.w.'..!N.*...W...t.N....L.<9...6.?ym.....Ny&#....k.OB.[^.Va(..\;c....q...P..V;.o.i.......8.9..W!..N.(.:s.V../3...l..=.4..I......5....].......Q...g'.=VT.......%.w.M..v.".].~Zx......N..Q...e....v.!..A.R?)pX}.9..Sy..A'.K.vW...@.6..&Y...g.mMs....9..`'..N-.../a...g.s[.4...sr.~....+...tJ..7....:Gt.......V.7..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\easyrecipesearch-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 284 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12326
                                              Entropy (8bit):7.929300643330138
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:782DF8C688A539B5C505C1EF4B3126FB
                                              SHA1:EF59A371F165C6AB0F285D9991751258D59F5FDA
                                              SHA-256:29646E547393E4D02D83FF0924AB73C0DC472C9360DAB46775872FD786C8A877
                                              SHA-512:E34D5704567C7C8A324C45822E06957F839820F96E118D97501E048127692E8FCC0107D45F911CD583622CC4CACA15D83C5469FFEF203A7D809973EC2D32E457
                                              Malicious:false
                                              Preview:.PNG........IHDR.............I.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:27:05-04:00" xmp:ModifyDate="2022-08-15T15:50:16-04:00" xmp:MetadataDate="2022-08-15T15:50:16-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:DocumentID="xmp.did:2b729d71-c191-44af-9e24-7a992c2d9ed3" xmpMM:OriginalDocumentID="xmp.did:2b729d71-c191-44

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\easyrecipesearch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 283 x 244, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):12411
                                              Entropy (8bit):7.921263449817116
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8DDC45DE75059C159BEC5007FF1404D7
                                              SHA1:83716A303CF5DD3BC539B7EC38CC52B69A5559CD
                                              SHA-256:6CF2A91AADCDDE82177D03A805E89F38031C64D8918104031723F9437966E624
                                              SHA-512:F732BBBEFEA003908875A6D1A2628F0549EEEA5C07BE0799B177BD024BA8D06C86A468AFB5315D177A832C74FB226735488D0F3562B0A57B45F024624A12629C
                                              Malicious:false
                                              Preview:.PNG........IHDR..............H......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.4 (Macintosh)" xmp:CreateDate="2022-07-14T16:26:56-04:00" xmp:ModifyDate="2022-08-15T15:49:34-04:00" xmp:MetadataDate="2022-08-15T15:49:34-04:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:0b9af62c-aa6d-4c37-865c-d9b6c864ba84" xmpMM:DocumentID="xmp.did:085ed0f9-6c3a-4374-ba8d-3a3f87a1b449" xmpMM:OriginalDocumentID="xmp.did:085ed0f9-6c3a-43

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\frompdftodoc.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 367 x 368, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):25832
                                              Entropy (8bit):7.885028171688866
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:925E71A27B02B252CBE4820F485E3DBE
                                              SHA1:0146BEB3083C4AA1004A6B49E04163A3E6F529E3
                                              SHA-256:BDCBAD60A23278C8A751996150F7EF3FD3C78B840C5F6F0938895854A50D848F
                                              SHA-512:9CDA793BCFEAE25CEF332833E4ED3E6533422D730D0E244BF30A860A8E4F6518BD300912300162C589891577B7A5712B0F53B10A9155F7EF584CFB0766394728
                                              Malicious:false
                                              Preview:.PNG........IHDR...o...p.....w..Z....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:08-04:00" xmp:ModifyDate="2022-08-15T15:49:08-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ca39defb-dd3e-49c2-bcd9-7c54cf636c0a" xmpMM:DocumentID="xmp.did:02A991BA22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\manualslibrary.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 365 x 365, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):20393
                                              Entropy (8bit):7.8580295440432195
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0EDF4F83BE815250749A6FD54DE260D8
                                              SHA1:A793A31D2D5042679D0A03A62FC7F0158CC57CD8
                                              SHA-256:FB70134C3485BC5856C134A32CF76BB526E320A52FBF7DA87061F4B7858722F8
                                              SHA-512:82815B5973A8CB6D50201FEF15F51149724FF7D73220C85CBE857D4AC4B057D4B5EC6249E276E45D60D80F70A083F3C0CCE0F69CD345FFE5349AA593D87F0ACE
                                              Malicious:false
                                              Preview:.PNG........IHDR...m...m.......;"....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:58-04:00" xmp:ModifyDate="2022-08-15T15:48:58-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:c4750f12-e0ce-4b1d-a63a-927c0459efe7" xmpMM:DocumentID="xmp.did:892ABEE522D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\mapsrch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 381 x 389, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):33271
                                              Entropy (8bit):7.931594779012815
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FC232AE58CD0528E7E8D3F67D0ACEEBF
                                              SHA1:3857232411D57A047190B5B9C2BE3E0C8A92ED74
                                              SHA-256:AE006C9FADD4784856BA915B18D97EAD1914D5FF09479D61EAD2BBC22A2BE7A7
                                              SHA-512:639DF2735F857BB0B4AF2048F705333FECAD5FC76028FD138119412F4C98800391BB33931ACDDDEC0A4EBB715FEB066A5BA9F97736C092CD744F24194EAEBFBA
                                              Malicious:false
                                              Preview:.PNG........IHDR...}...........#%....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:48:33-04:00" xmp:ModifyDate="2022-08-15T15:48:33-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:45aba724-7e24-4abb-9732-74866178ba21" xmpMM:DocumentID="xmp.did:02A991BE22D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\myofficex.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 368 x 367, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):14431
                                              Entropy (8bit):7.707181165494393
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:85C5570D6E65EEC42CF2E3F7713A66C3
                                              SHA1:0A763E4E794E0E1A3A1710BD6E1C322D6A32F25A
                                              SHA-256:FF4A851155EB49A1254A7E7018E076E7BD530213B44B070BD797DADC81B9DDAA
                                              SHA-512:2A49BE0D434C5766DE45B7F92ADAE2C6BFCA67A973E4D5C1C298E9B7D8ADBC474949D6C18A1F424E4C534B86FAC8F69A8AE07487E0139C7F7B081E6AAA6623FC
                                              Malicious:false
                                              Preview:.PNG........IHDR...p...o.....S..q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:50:03-04:00" xmp:ModifyDate="2022-08-15T15:50:03-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:ff7b6b93-7f23-42d2-a7be-2f5beef1df3b" xmpMM:DocumentID="xmp.did:20634D1922BD11EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\logo\tvsearch.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 374 x 333, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):18459
                                              Entropy (8bit):7.844984747112504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED9895C2AC598081CE14D23026D9A151
                                              SHA1:DAA258574681AE6B72662F76EC94C349103E2A1D
                                              SHA-256:30F7A3BA7CAD2D24C11F42F27D8F5E25172E7FA39C6BA234B517F30694C77952
                                              SHA-512:E673A4C70C3170AEB50FBAE98B46377D0C81CEBCA1506CB22382148C932B9AA90F5B1500D5B744EB75C941B4B548D02258282DC675E3C96E32AA7102024D8B07
                                              Malicious:false
                                              Preview:.PNG........IHDR...v...M.......D.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5b4, 2022/05/09-08:25:55 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2020-08-27T12:44:54-07:00" xmp:MetadataDate="2022-08-15T15:49:51-04:00" xmp:ModifyDate="2022-08-15T15:49:51-04:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:5168d161-c055-4622-aa7b-21e7e78e7134" xmpMM:DocumentID="xmp.did:892ABEE922D011EB9643EC05BD06FD39" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\lunch.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):16513
                                              Entropy (8bit):7.942775799800354
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:567AF05C7E2D43347973BEC4CF343E0D
                                              SHA1:08BA0FE7AD9F162FCB0ABCFF7851EB61F0DC4E0D
                                              SHA-256:ED8AB87EEF9B4F95DAB1BEA79A1D5871112DB5ED0C43C3EF18DD4014AE7BC78A
                                              SHA-512:9C2CAE92250E70107816B00304D577A84F9803FA98C7201EA3B5DD253FF898A39BED46273820D93B17DA30F008C1B8C48C0A848A8B052E62784C2C5A8E7B2518
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:CC68561D3C3811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:CC68561C3C3811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\mic-light.ef89f88c.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):748
                                              Entropy (8bit):4.56981083024606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EF89F88C7B01DA5750C445CF27B29F96
                                              SHA1:2D1BBEA85AE56A5B8EED6FBC329D349CD8788380
                                              SHA-256:27B5279E497A86EA1A0BDCC2410AF994DE8B4E302E73B0A6733EEACEFF104273
                                              SHA-512:45256E300A4B73B716A2C30B12345FC587CE420F850D855A383A96A6AC5103E0D3A9C44350238AEFE9DEFF88FB0A5976991911219C17BFB1E5279B724A8D8638
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-093df64d-105f-463c-949c-3ac771fa2a44" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 181.9 256"><path d="M37.66,238.08h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H20.9v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H37.66s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V59.26C33.71,27.1,59.87,.93,92.04,.93s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V59.26c0-22.39-18.22-40.61-40.61-40.61Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\mic.0bbff27e.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):763
                                              Entropy (8bit):4.642583523048806
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0BBFF27E10FB770AE61B7697126D55B4
                                              SHA1:64285085506DB8096786614F00C888608F1D43C2
                                              SHA-256:657ADC2975B48DBDFCF2165ACBABD001FA4D3649BAF49E2B849A0935F8D41F90
                                              SHA-512:EB47A8F1C99131E49E749E242436DEA7066D6EA6A6010ADD768C64EA09E5CCEFE8786AB6B412682C13C3A6EA609808BE2D371596249E4095261E35480265DA19
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-5fb4be14-1b1e-45e4-a6e0-8a4d6081bac2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 180.81 256"><path d="M36.57,237.64h45.52v-18.17c-21.5-2.13-41.4-12.02-56.23-27.97-15.33-16.49-23.77-37.95-23.77-60.41v-1.99H19.81v1.99c0,39.22,31.91,71.13,71.13,71.13s71.14-31.91,71.14-71.13v-1.99h17.72v1.99c0,22.47-8.44,43.92-23.77,60.41-14.82,15.95-34.73,25.83-56.23,27.97v18.16h45.52v17.72H36.57s0-17.72,0-17.72Zm54.38-48.21c-32.17,0-58.33-26.17-58.33-58.33V58.83C32.62,26.66,58.78,.49,90.95,.49s58.33,26.17,58.33,58.33v72.27c0,32.17-26.17,58.33-58.33,58.33Zm0-171.21c-22.39,0-40.61,18.22-40.61,40.61v72.27c0,22.39,18.22,40.61,40.61,40.61s40.61-18.22,40.61-40.61V58.83c0-22.39-18.22-40.61-40.61-40.61Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\more-light.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 86 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):613
                                              Entropy (8bit):7.505868006470174
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:14D075B4378076AD25B701539C02DF96
                                              SHA1:414E00CFB385A0BE18D990A03B992B5E865B3106
                                              SHA-256:ABA4B4A82D8CF18D1A1E4D07CE22244D42BE1F3EF4ADA6D0D64BE4179FA0194C
                                              SHA-512:94D84FC408A76751AA60525F0F0E6AE95D91BB2409ADA661F64E7BE6DEDA8CD5218E185ECF94E9A4A9AB78FE70E677B8053A4B75A00A91F2B376324F7831CD24
                                              Malicious:false
                                              Preview:.PNG........IHDR...V...?.....z.?e....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..=R.0.F.t.....%.K...GpK....>...#....2.T 3..xl.%..of3.....>.!Fr.+.........@..7../']..{.`...M.c..P...RN.es./mU.........:.........;oUU.'......J..}...N..<..tV...YU,]..............q.'s.[.....o.{1.........t.q...P.*.n..5#..+)A..Z.6dQ3)X8[Bh...k.B...5...J...D.".........+..Jm...O.....>..&jrWVW...];:..2v..QcH.@..x|m;.t.b3.g`S_.>...<....5...A.>..+.E..)..(j....1..$[..IX\.55..MQ.`.].d$<6DME.$!...EMJ.e.QSR.1)jZ.-@Y.kR.x-X\.5.!..N3.&.J~Q..!....._..,.D.........EMp.e/Q......`..O.h.<..`. ..5^LW..../m..[.b.....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\more-light.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):281
                                              Entropy (8bit):5.122239544537466
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:13650B9DB846874266E3CCC07CA5CE32
                                              SHA1:F2C20BED7A4D20C5383933B6ECB47B6A11A0F0C8
                                              SHA-256:6B2710F34B4AC3A7A5598379D6D7E10BA2F05E1144F5B0D108067D8D951F74C1
                                              SHA-512:E296176A8C98D1AA381851C762D8C9A184F6FB2C397AB937690A70782CE231828130C587F5573FCE578648F77ED51F430ED3965A820781DBCFA580FAAB824E12
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-f6652119-682e-4917-b672-410928dc3ab0" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 86.27 63.39"><path d="M42.33,62.27L.76,2.27c-.38-.67,.1-1.5,.87-1.5H84.77c.77,0,1.25,.83,.87,1.5L44.06,62.27c-.38,.67-1.35,.67-1.73,0Z"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\more.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PNG image data, 85 x 63, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):834
                                              Entropy (8bit):7.615610965947915
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C90F517490906E9AB18830ED7F4E907
                                              SHA1:A4E00F6A2E0CE560F2B9766768338564D9C1700E
                                              SHA-256:FE5F54CE9DF939D46F927CD9F395F90F6372AB8466DAF4F283A094C96AD6265B
                                              SHA-512:0A98F081B407E4F5EEAD2A0385D9938F41302C452ABF0B5C34EB0CC15410C168B09B92F2F20DF014ED7B62794FEADD5261CDD0E255C787B8F21D663E82493DC8
                                              Malicious:false
                                              Preview:.PNG........IHDR...U...?........f....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0..e.r...A..t@:..$%..R......H...r..V..Q..[.+kw.c2.l.7....\0......rR...I(.U..Y.T........B.P...`..pz!$......,.:........6...n.b..=o_bcT[.w..T....."N...@..-.S..l@...*...`.....d..[...+.6.$n......}..T.a...Q.%...d.'....O}@G;U.........h3:..@......_......d.-m..e..U.........*t..y....L.b.sU...\e?....E....\.)U..!...&,....Q.T..M.a...[._*l.:..7,...x&.;.:S......_.....w..P+.~.....K]yjg.-K?til.:.*....L.K.._..R.]&.%.;5.i.m.>.0..E+,.".......aI.NM....'N..O[FaIT.+V.-t1.K.w........P....)..%....X.%..V,^.....w......Z./tiB...U....l].%..L[.B..a..N.0m...(P.X.G...uX.V.....]..%.;..D}m)*T....WX.^.....]..%.Au1m.......i.....@Qu.......3.w.0B5..x........mV....B.`uB..aI......%.v....[......O.&:.6..-....]J@...E...Z.}.........%D.Z......IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\more.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):296
                                              Entropy (8bit):5.19526902417027
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5EEC7F4D239CF63B9285FE15A4F57512
                                              SHA1:76DE76A228ACC2648C1E38D549903E6525CEBA56
                                              SHA-256:7F1EC6026B52B090FB34C5B74F7F2B51D928C0AA71EA54EBAB2D9D2599C47A2B
                                              SHA-512:8449EB9685B0FB85FE7F94D8DF50DCF3ED81C3350F974E96C7D2E8C531354F06553F7309368D38C0FEB26C56E7E79E807A684D9C5F04234573FC0D36737C03A3
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-bee40dd1-2471-4301-8deb-eaf3ecd2ae18" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 85.18 62.3"><path d="M41.68,61.93L.11,1.93C-.28,1.27,.2,.43,.97,.43H84.11c.77,0,1.25,.83,.87,1.5L43.41,61.93c-.38,.67-1.35,.67-1.73,0Z" fill="#fafafa"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\pork.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):25850
                                              Entropy (8bit):7.966502967314044
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4DAF153E67D93C520B1F82F58CFA4108
                                              SHA1:57E13EC76EF9782E8F19DDC09576C80F81BFF62A
                                              SHA-256:D6DBD6E72014DA20698F44A3F4FD3BED23FED199B4B0A388FE86E49569F8D0CF
                                              SHA-512:E7F93B456B700B9164D8FE2ADE8FF7CA06EA5372DE8069D2093DDE0B004D3EDF0FD236EC0044FC69C2883621E7C231D2A07BDA281178DFA5A33C939D91DB11D0
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:40800F903B4811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:40800F8F3B4811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\search.ea2d187a.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):855
                                              Entropy (8bit):4.81612280577504
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EA2D187AB99C9ECBBEB0E6F01C57305F
                                              SHA1:BA6B2CB8BFA3E50368F100135864D0035026DB85
                                              SHA-256:29DA250519E6F110445DDD8661DA13CA1349B316C7FF7D39AC106A17A9EFB7DC
                                              SHA-512:05FF9F011B81F80601838C3F02E57F6764C30EA280F615E8AE339F85BC2ADD244FAFF227C72370477F6D9E8E07D608F44A58EF14A4D4579A337FCB7EB6C5436E
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-cf429962-4ab6-4218-9108-72f55db9e797" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178.72 177.9"><path d="M79.17,17.77c15.86,0,30.77,6.18,41.98,17.39,11.21,11.21,17.39,26.12,17.39,41.98,0,32.74-26.64,59.37-59.37,59.37-15.86,0-30.77-6.18-41.98-17.39-11.21-11.21-17.39-26.12-17.39-41.98,0-32.74,26.64-59.37,59.37-59.37m0-12.51C39.47,5.26,7.29,37.45,7.29,77.14c0,39.7,32.18,71.88,71.88,71.88s71.88-32.18,71.88-71.88c0-39.7-32.18-71.88-71.88-71.88h0Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/><path d="M165.55,172.88c-1.71,0-3.42-.64-4.75-1.92l-37.69-36.42c-2.71-2.62-2.79-6.95-.17-9.66,2.62-2.71,6.95-2.79,9.66-.17l37.69,36.42c2.71,2.62,2.79,6.95,.17,9.66-1.34,1.39-3.13,2.08-4.92,2.08Z" fill="#8390a5" stroke="#8390a5" stroke-miterlimit="10" stroke-width="7.7"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\steak.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):33987
                                              Entropy (8bit):7.974065595312435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:592AA1ED03E9E24A5EAE21C836108241
                                              SHA1:34CAB4FC3E4F0177843A2CA028413ECB935F1C46
                                              SHA-256:6CCA3A9484F72527B79E5704CB414BC87C4355273D89F8C241F446D2A2A57452
                                              SHA-512:3C6F7CE1D5D019F55FA0E948814516C41310D70161B034CE9E0BEF102A5864898EC210A25BD799E21EB1D851899A718837DFBC586C62AC619453D9B5FB87F1D7
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="uuid:9C11CD8205F311DCA887CA016C02A162" stRef:documentID="uuid:9C11CD8105F311DCA887CA016C02A162"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:Descrip

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\vegetarian.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 400x298, components 3
                                              Category:dropped
                                              Size (bytes):24615
                                              Entropy (8bit):7.962130867825671
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0526B40A38A67CD9AD1E102E180C81CE
                                              SHA1:5AD86CA42AAEE32D27EB993D0E47EC4BEB56F795
                                              SHA-256:152E0495B75B8A3A076ABBC7960899628A1CC223F3D4C84147CB3C149A283774
                                              SHA-512:B784D6E45F8FC232E5329B689473ACAADF5A1FA66187690CF4175FEBB5DAE7953BCBA22C2F9C1706255A4658DE6875812883D91D2A8AD8844E83183690B7EF9A
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpRights:Marked="False" xmpMM:DocumentID="xmp.did:3B9F58083C3911EBA6F7BE6BE6B697E4" xmpMM:InstanceID="xmp.iid:3B9F58073C3911EBA6F7BE6BE6B697E4" xmp:CreatorTool="Adobe Photoshop CS2 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E5AF8730F811EBA6F7BE6BE6B697E4" stRef:documentID="xmp.did:D3E5AF8830F811EBA6F7BE6BE6B697E4"/> <dc:creator> <rdf:Seq/> </dc:creator> <dc:title> <rdf:Alt/> </dc:title> </rdf:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\img\warning_1.20159b81.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):611
                                              Entropy (8bit):4.964280503304786
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:20159B8157E32141FA261B2E4B8762CE
                                              SHA1:7448DA874E7EBF7A32AA19E4BD9B032109E26EF4
                                              SHA-256:0AC1C7A5F463B1392F083BF4954FC3BF01F112C65E0108989CC83D67E94DFBBF
                                              SHA-512:221E0DCC73BD5697042542C5D4C2AD6E8E474F94A475B03426197621A986E5717C62CD54494E9D5C9AB2594807D8A925019750DF33658E584E638359968323DE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="uuid-9fb3a897-7bdf-45b4-8e9a-38d981f52fec" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 229.85 201.51"><path d="M108.8,5.77L2.82,189.34c-2.64,4.58,.66,10.3,5.95,10.3H220.73c5.29,0,8.59-5.72,5.95-10.3L120.69,5.77c-2.64-4.58-9.25-4.58-11.89,0Z" fill="#e8101e"/><path d="M102.15,172.18c0-6.8,5.6-12.8,12.6-12.8s12.6,6,12.6,12.8-5.6,12.6-12.6,12.6-12.6-5.8-12.6-12.6Zm23.6-114.8c0,7.4-2.2,26.4-4.8,54.4l-2.6,27.8h-7.2l-2.6-27.8c-2.6-28-4.8-47-4.8-54.4,0-8.6,4.2-12.2,11-12.2s11,3.6,11,12.2Z" fill="#fff" stroke="#fff" stroke-miterlimit="10" stroke-width="8"/></svg>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\index.html

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:HTML document, ASCII text, with very long lines (759), with no line terminators
                                              Category:dropped
                                              Size (bytes):759
                                              Entropy (8bit):5.046289682227188
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:888D46A998A4E9B3853789F36160430E
                                              SHA1:D6AADA9407C26D8084154FA973A39A9AC961EC2B
                                              SHA-256:35ED7ED4219F5D9B1B61CAD6E384BF8A3CC9F6CCE11C828E1944A3DAA94E0521
                                              SHA-512:C266C57EE6F9F2E826A3527AA09A3B149C0DAC6DC7BBBD88C745B14B024732574DCDD0EEACE543B606EEF6ECD9BDC5ACBD1280136F7176AC54FAF1CF87512F1E
                                              Malicious:false
                                              Preview:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta name="viewport" content="width=device-width,initial-scale=1"><title>appbar-ui</title><link href="css/app.29e34c24.css" rel="preload" as="style"><link href="js/app.3f57d9f7.js" rel="preload" as="script"><link href="js/chunk-vendors.f61cf75b.js" rel="preload" as="script"><link href="css/app.29e34c24.css" rel="stylesheet"></head><body><noscript><strong>We're sorry but appbar-ui doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="js/chunk-vendors.f61cf75b.js"></script><script src="js/app.3f57d9f7.js"></script></body></html>

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\it\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.368637490829895
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1C331DA4BCE2809E16913C02E385576E
                                              SHA1:CF8E71E030347749596A53D1B13B9E9583EC0527
                                              SHA-256:1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
                                              SHA-512:2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\js\app.3f57d9f7.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with very long lines (14987)
                                              Category:dropped
                                              Size (bytes):251953
                                              Entropy (8bit):5.573793846059789
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C7401254BB1D6522799E4C76C785E248
                                              SHA1:7CF68C5727A8D7766DE7CEF634355611B9CA46EE
                                              SHA-256:B1A93C1BBB6B75F7D2745FAF12AE32F68B0DFC5A975C5EFD74DF14CC59D8E5C1
                                              SHA-512:54F9AF8DEEB28F818B21FA1E5D44F66780B22428F359DBCAA3D00DCE04812A671D025654DC38E64D492BCB465975974C810111037D39163EBE72313A9CA3429D
                                              Malicious:false
                                              Preview:/******/ (function(modules) { // webpackBootstrap./******/ .// install a JSONP callback for chunk loading./******/ .function webpackJsonpCallback(data) {./******/ ..var chunkIds = data[0];./******/ ..var moreModules = data[1];./******/ ..var executeModules = data[2];./******/./******/ ..// add "moreModules" to the modules object,./******/ ..// then flag all "chunkIds" as loaded and fire callback./******/ ..var moduleId, chunkId, i = 0, resolves = [];./******/ ..for(;i < chunkIds.length; i++) {./******/ ...chunkId = chunkIds[i];./******/ ...if(Object.prototype.hasOwnProperty.call(installedChunks, chunkId) && installedChunks[chunkId]) {./******/ ....resolves.push(installedChunks[chunkId][0]);./******/ ...}./******/ ...installedChunks[chunkId] = 0;./******/ ..}./******/ ..for(moduleId in moreModules) {./******/ ...if(Object.prototype.hasOwnProperty.call(moreModules, moduleId)) {./******/ ....modules[moduleId] = moreModules[moduleId];./******/ ...}./******/ ..}./******/ ..if(parentJsonpFun

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\js\app.3f57d9f7.js.map

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):292122
                                              Entropy (8bit):5.517956957809695
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F893C045B9D5D8493F8B8AB051A1D304
                                              SHA1:F99387F31560AB07BD2AE9E439C88CC1BB8E75C3
                                              SHA-256:12A437D3CE12A6662D262A131E9B00FA03D56E854AD3D7C35FACD22A21EDA111
                                              SHA-512:E1F7FC7DC5C6448490A51DAACE4C8517DE577421D25AD31DD7815969F8DA0EFFB96DACA6AB12278FA3E6386F5F0218DBD105536A7B3A27F3632EA1E4581E4A29
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///webpack/bootstrap","webpack:///./src/components/Win11Pin.vue?d239","webpack:///./src/components/AppGrid.vue?7577","webpack:///./src/App.vue?9b05","webpack:///./src/components/ClipboardListWin11.vue?40a3","webpack:///./src/components/AppTiles.vue?a340","webpack:///./src/components/AppList.vue?f4ba","webpack:///./src/components/TilePin.vue?4458","webpack:///./src/components/AppTiles.vue?3dab","webpack:///./src/components/SearchBox.vue?faa4","webpack:///./src/components/Dashboard.vue?2b41","webpack:///./assets/img/files-light.svg","webpack:///./assets/img/cameraandmic/mic-light.svg","webpack:///./src/components/AppNav.vue?4a0e","webpack:///./src/components/ClipboardTiles.vue?8d91","webpack:///./src/components/CloseButton.vue?0d46","webpack:///./src/components/SearchBox.vue?cad1","webpack:///./src/components/SearchAddonBox.vue?6e69","webpack:///./src/components/autoCompleteInput/AutoCompleteInput.vue?f9af","webpack:///./src/components/Win11Pin.vue?0a5c",

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\js\chunk-vendors.f61cf75b.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):619670
                                              Entropy (8bit):5.039268103866988
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E0959383F2F45C75B117F903A1808590
                                              SHA1:22EC6A28A5BB2116D7A69240E6FA2CBB615ADB32
                                              SHA-256:768CE947DC088EC57E9630175B213585C1CF9C90432DC8599812CD0F199EC6E8
                                              SHA-512:658770620E5A4D9AAA7F1DE9C55FC08B9B03CDC74B6DBAD3A1EDB40924D00E254EA65795DEBFC5E4265F4AA0787E556BC3273B9C812ACDA0B443481945A99E0C
                                              Malicious:false
                                              Preview:(window["webpackJsonp"] = window["webpackJsonp"] || []).push([["chunk-vendors"],{../***/ "00ee":./***/ (function(module, exports, __webpack_require__) {..var wellKnownSymbol = __webpack_require__("b622");..var TO_STRING_TAG = wellKnownSymbol('toStringTag');.var test = {};.test[TO_STRING_TAG] = 'z';.module.exports = String(test) === '[object z]';../***/ }),../***/ "0366":./***/ (function(module, exports, __webpack_require__) {..var aFunction = __webpack_require__("1c0b"); // optional / simple context binding...module.exports = function (fn, that, length) {. aFunction(fn);. if (that === undefined) return fn;.. switch (length) {. case 0:. return function () {. return fn.call(that);. };.. case 1:. return function (a) {. return fn.call(that, a);. };.. case 2:. return function (a, b) {. return fn.call(that, a, b);. };.. case 3:. return function (a, b, c) {. return fn.call(that, a, b, c);. };. }.. return func

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\js\chunk-vendors.f61cf75b.js.map

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):982979
                                              Entropy (8bit):5.202736638047451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDF908A8E47C181C1076EE02BDD710BB
                                              SHA1:572EAEF2B8EE3371D41AE9D74C66309DAAA1FD4C
                                              SHA-256:8B02BDFA48F962DA79A2101E2F056C16EA2829FDFD9E0F9E034F757529B77A74
                                              SHA-512:FDBBFA90906F10B82D0AE6DD1CFB0A3D47D684FCA19146ACEB953DBBEDC67BB4293783DD80F7AA02C66BBD1B606B7CC22AE78C46293F832684BA92A98FC38554
                                              Malicious:false
                                              Preview:{"version":3,"sources":["webpack:///./node_modules/core-js/internals/to-string-tag-support.js","webpack:///./node_modules/core-js/internals/function-bind-context.js","webpack:///./node_modules/core-js/internals/object-get-own-property-names-external.js","webpack:///./node_modules/@babel/runtime/helpers/nonIterableSpread.js","webpack:///./node_modules/core-js/internals/object-get-own-property-descriptor.js","webpack:///./node_modules/core-js/modules/es.object.values.js","webpack:///./node_modules/core-js/internals/ie8-dom-define.js","webpack:///./node_modules/core-js/internals/native-url.js","webpack:///./node_modules/@babel/runtime/helpers/iterableToArray.js","webpack:///./node_modules/core-js/modules/es.string.split.js","webpack:///./node_modules/core-js/modules/es.array.reduce.js","webpack:///./node_modules/core-js/internals/regexp-exec-abstract.js","webpack:///./node_modules/core-js/modules/web.dom-collections.for-each.js","webpack:///./node_modules/core-js/internals/array-for-each.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\netstandard.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):98616
                                              Entropy (8bit):5.627990537858435
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0ADF6F32F4D14F9B0BE9AA94F7EFB279
                                              SHA1:68E1AF02CDDD57B5581708984C2B4A35074982A3
                                              SHA-256:8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
                                              SHA-512:F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M...*.M...*.M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\pl\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10240
                                              Entropy (8bit):4.594776627495051
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B60817A69E314B22F746917C826DA53E
                                              SHA1:7D2785A6D1A53A0717C986B959AF67DE6F9300E4
                                              SHA-256:6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
                                              SHA-512:9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\ru\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):10752
                                              Entropy (8bit):4.846136752240531
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:DADE13E423762BDAE745D57CA3DC86EF
                                              SHA1:7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
                                              SHA-256:1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
                                              SHA-512:77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x64\SQLite.Interop.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):1784736
                                              Entropy (8bit):6.555430781989463
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1288823E8E1FCA09BB490CE46988188D
                                              SHA1:B07FE4A5D032296E3A7D0727216AF8C1D2166E91
                                              SHA-256:6514973856D1767CCB375DCB253400E710FB4F91FEB758041D8DEFE92B1886C5
                                              SHA-512:88967F64116951092A54118055EAB462082F16676EA7565F42515E88765813B53CDFBBA5181318E73B668E04DDD030A0BFCF5CF47936772F68DF85488B865ACD
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..;...;...;...!./...#...."......D..<....D.......D..+.......3...%HC.8...;......D..:...D..:...D/.:...D..:...Rich;...........................PE..d......b.........." .....@...................................................P...........`..........................................J.......b..x.... ..........l........I...0..`......p...........................P................P...............................text...@>.......@.................. ..`.rdata..."...P...$...D..............@..@.data....`.......J...h..............@....pdata..l...........................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\x86\SQLite.Interop.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                              Category:dropped
                                              Size (bytes):1392544
                                              Entropy (8bit):6.788598919509379
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B68A8D0393FBCE1976C19107422F097
                                              SHA1:B645FC9AFF04F1DE9D31D4C4B965AE0A1E3549D0
                                              SHA-256:F16DEA838EFC5B074F8D8B2F8E14AB77EC744648B1D5DD550456C2F99C12BBDC
                                              SHA-512:7989B760012FCAB665591C2528D8ECAEAD09CD9CD74A7208EF6177B36581D381574D007A31BB4C55DA7BC793000BF71BE546B1CAEC59C380AB8962EA2B719933
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.............jO......jO..^...jO............................,..................F...I.......I.......L.......I.......Rich............................PE..L......b...........!.........L...............................................@......J.....@......................... "..L...l:..x........................I..............p...............................@...............@............................text............................... ..`.rdata..~...........................@..@.data...X9...P...,...2..............@....gfids...............^..............@..@.rsrc................`..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.701646036890297
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3CEFEC17BAAC089C54C8102A4CFD160C
                                              SHA1:A54CD9BD4181A591937A99BE88BEB006279837DE
                                              SHA-256:AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
                                              SHA-512:2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Net\app\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):9728
                                              Entropy (8bit):4.728551774224484
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:833F269BA6F0C34F49273DA7FBD7DCE7
                                              SHA1:D0253D322DCDF7F54E37C7E8911A8B77670D2967
                                              SHA-256:F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
                                              SHA-512:4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Networking.dll

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):34304
                                              Entropy (8bit):5.658759389778389
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:EDBAD5CCE582E8C56A25F0B64B44D900
                                              SHA1:5464F69931EB97E468EC310A61521AAE9AFA9054
                                              SHA-256:3E0A9CB4B739A4555DCF8915D1CD3D9821A2E1C8ADAAA98D3917B6E38F963547
                                              SHA-512:9CB9F28C320D8FF240E29F2D87077EA3AEAB830C6596DC7F20DE357EF3625621F50694B958682D5B2AA24D7843486D66F769F1C12224F36634BBEF33388C49A9
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.e...........!.....z............... ........... ....................................@.........................(...(...<...O............................... .................................................... ............... ..H............text....x... ...z.................. ..`.sdata..x............~..............@....rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Profiles\profile_map.txt

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:modified
                                              Size (bytes):410
                                              Entropy (8bit):4.311824882740019
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6444764B2CF9F2B2C274787263A78CCB
                                              SHA1:0284957AC5E3C40D75B4D1B2E79F9EF954B1A890
                                              SHA-256:1AF45A6C76B8BAA3CC167690EB748D8C367D1B5E98FE3581B6D8975632FF07F7
                                              SHA-512:1E0C9B7AA97127FEE1B8B927C9863C7BF28B401691CC4D625D1A948C5ADD96B47E0C09A6D511AE3AF9ABBB1C007460072B8E1387D66843809D0515DC0C1D816F
                                              Malicious:false
                                              Preview:frompdftodoc=pdftodoc_clearbar.json..tvsearch=tvsearch_clearbar.json..manualslibrary=manualssearch_clearbar.json..myofficex=myofficex_clearbar.json..mapsrch=mapsrch_clearbar.json..templatesearch=templatesearch_clearbar.json..easyrecipessearch=ers_clearbar.json..clearbarinstaller=ers_clearbar.json..manualsdirectory=manualsdirectory_clearbar.json..easyprint=easyprint_clearbar.json..clear=clear_clearbar.json..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\Profiles\templatesearch_clearbar.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1005
                                              Entropy (8bit):5.383805164772034
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4497D92A069CDEDFF2CFFF72984F4D68
                                              SHA1:91018B6F7320BCEE5CC906F7EC8ADE8E65017691
                                              SHA-256:52EF33D03322BA1AE1E4DBF2CAD9E1666A50120B8405612E162F4DDD5A20F259
                                              SHA-512:B16C27B6E87E3A0B6720191D9AAFB4C4FD0B4DCF21AB69ABDA0A5F63E326875E6245A4B13934132A878640D479DD34B8FF9C0341289E0F13D45ADC2C6B7BCA70
                                              Malicious:false
                                              Preview:{.. "ThankYouPageUrl":"https://clearbar.app/rd2/?id=202336Ly9hcmNhZGV0YWIuY29t&guid={guid}&ext.id={profile.BrandName}&ext.version={app.version}",.. "FirstRunUrl":"https://clearbar.app/rd2/?id=104162Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "UnInstallUrl":"https://clearbar.app/rd2/?id=215388Ly9hcmNhZGV0YWIuY29t&guid={guid}",.. "SearchUrl":"https://search.clearbar.app/crx/search.php?guid={guid}&q={searchTerms}&action={searchAction}",.. "SuggestionUrl":"https://meta.clearbar.app/sug/?s={searchTerms}&output=json",.. "ChromiumSuggestionUrl":"https://meta.clearbar.app/sug/?s={searchTerms}",.. "BrandDisplayName":"Template Search",.. "BrandName":"templatesearch_ClearBar",.. "FeatureUrls":{.. "weather":"https://www.yahoo.com/news/weather?fr=trp&type=Y223_F1_203541_{user.InstallTime|format_mmddyy}",.. "app-icon":"https://search.yahoo.com?fr=tightropetb&type=11745",.. "maps":"https://maps.google.com".. },.. "BrandTags":["templatesearch", "-manualsdirectory"]..}../* -{ "Sample": 123

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\_isetup\_setup64.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                              Category:dropped
                                              Size (bytes):6144
                                              Entropy (8bit):4.720366600008286
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                              SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                              SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                              SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                              Malicious:false
                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\common\browse_icon.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 30 x 23, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1679
                                              Entropy (8bit):7.127104300428268
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9C26F5DD459C12F2F8A28CAFB7447520
                                              SHA1:8E80481D866CCFECB0BE5AF772FA456197F3100E
                                              SHA-256:3156AD4638AB7AE34E17E07A4BFC0E2509690B886506035DC92EF0EA8ADB0847
                                              SHA-512:46343411C69CCBD87DE2DCB18DFC01EC6EACE81CCF0BBA142E12D4901FE9D2C783063F290C49D0E2253D6CCCDE63EFAD5748E3AD8095554FC96410D1D633D43A
                                              Malicious:false
                                              Preview:.PNG........IHDR..............?.j....tEXtSoftware.Adobe ImageReadyq.e<...uiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce" xmpMM:DocumentID="xmp.did:405429C7FFF911EAABE4F06A353F0EF9" xmpMM:InstanceID="xmp.iid:405429C6FFF911EAABE4F06A353F0EF9" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:800f93bb-fff5-4b10-a807-9a6ec0d06b2f" stRef:documentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.V=k.A.~fv.n/.KT...|..H

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\common\check_badge.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 17 x 19, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1406
                                              Entropy (8bit):6.819433511833457
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5BB846C7F7965BB689DC678AF686C9BF
                                              SHA1:968EAF0A2C169D8738052CB928607BDCBC664866
                                              SHA-256:DFEDC430D48922DDC24166AF1EF4E2B77112386602CB6BE15686C6A60E0D0F5C
                                              SHA-512:0945322EDF5E0BC89192FD940A867578F69C16400C32F1F94A90AA6220D1206652B92DA78BF2089D95BFD36D613C12BA1D9970856559F851E664BC880B628413
                                              Malicious:false
                                              Preview:.PNG........IHDR.............v.......tEXtSoftware.Adobe ImageReadyq.e<...uiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce" xmpMM:DocumentID="xmp.did:405429C3FFF911EAABE4F06A353F0EF9" xmpMM:InstanceID="xmp.iid:405429C2FFF911EAABE4F06A353F0EF9" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:800f93bb-fff5-4b10-a807-9a6ec0d06b2f" stRef:documentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8......IDATx...+.Q...c....Bn.k.%..V

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\common\closex.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1075
                                              Entropy (8bit):5.189827252951011
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D181C9D9709E5029220B246CB4007327
                                              SHA1:0805408095500984B6BE4DEED4A49F2B9C2DCFD1
                                              SHA-256:7E86D106332D3AB2B0872D3015A7AC4AEF29E6A7B73B07E2CE6823C5C843A1FE
                                              SHA-512:82DC7AE1E32C513E4811F2857871BB925046DB5565B4055AC7AEBCF91E5E428407B13220CEF68FBE47A8A1EB3BA21A2BA0DBD7B1E47D8EF9F4B3CBD0A8A897C4
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 25.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_4" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 111.2 111.2" style="enable-background:new 0 0 111.2 111.2;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<path class="st0" d="M55.6,111.2C24.9,111.2,0,86.3,0,55.6S24.9,0,55.6,0s55.6,24.9,55.6,55.6c0,0,0,0,0,0...C111.2,86.3,86.3,111.2,55.6,111.2z M55.6,8.6c-26,0-47.1,21-47.1,47s21,47.1,47,47.1c26,0,47.1-21,47.1-47c0,0,0,0,0-0.1...C102.6,29.7,81.6,8.6,55.6,8.6z"/>..<path class="st0" d="M43.8,71.7c-2.4,0-4.3-1.9-4.2-4.3c0-1.1,0.5-2.2,1.2-3l23.5-23.5c1.5-1.8,4.2-2.1,6-0.6c1.8,1.5,2.1,4.2,0.6,6...c-0.2,0.2-0.4,0.4-0.6,0.6L46.9,70.4C46.1,71.2,45,71.7,43.8,71.7z"/>..<path class="st0" d="M67.4,71.7c-1.1,0-2.2-0.5-3-1.3L40.8,46.9c-1.4-1.9-1.1-4.6,0.8-6c1.5-1.2,3.7-1.2,5.2,0l23.6,23.5...c

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\common\green-check.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 50 x 57, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):986
                                              Entropy (8bit):7.721806197786618
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7F05D0A50CD14E33215C6AB3DE84FA9F
                                              SHA1:5574D4D783636A2E6DBFA8242F333F231B2ADDB2
                                              SHA-256:DE3168CAA9EE5026EBD96DA1F665A4C98762F29A53AEB480E107FB9DE7B342E8
                                              SHA-512:64F695C3D1663EFDD99C30BED5FDA589790AE1E41D90E2EA7293B80066466B3D9CB46EC270277EC63ADF11D27F53947F63D39312A7C5071663326FB0A348518E
                                              Malicious:false
                                              Preview:.PNG........IHDR...2...9.....t.xr....tEXtSoftware.Adobe ImageReadyq.e<...|IDATx...q.0.....P.SA.....\RA.... q..+...T R..\...tp.Z...7....9.c@...Z ....hg"i.>c.'.mZ.?.`....!.}.~.z.0p.0..'... $.3......*............y.......Y2(j.BR>.o.$C..Z..."A.T.AD.f...j..=..7N.a.>1.e}.."l..}.....^..;......~X.O."l.....M.....A.E.S"...uW.G.R.nq.9.N.....~[..I..8.... .......].V.._A...+.l..mz. .J..4.t{.C.9.5..W+.&...X.P...2...d.y...I....%.|s-:J...Yk.5GH!..9.P&<Sr.F...b.9.V.#..1......=.KK~.d...R....u@..._....D......Hi..P... ..w1.!V"1...-b..eJ.|9.I..D.RY.`B...H.A.c.._....A.\.....G9i..t0/=@$.1H3.{q...^..VZ}.L.r:....).0....t.Il.*..`hc.0WB9.7.v....h....V5J.e...^^$.<V+..z3n...1A\]K....sP...,$............b0......)...n.!C..{.m...^.'.[U.~A.+....n[..~Q.(/.rx...D...%....2.n.....SX..5.0...:.9Q..q+RyB.(........B.5..w>_.<..3o...^a..k...0....7.m}d.".L...@.$..A../y..J..6&.....I......y...:].r{V..E..S........g........~"...T?.z.*..r2......C.}..@....X...._....zum.s.....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\common\greenprogress.gif

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:GIF image data, version 89a, 256 x 40
                                              Category:dropped
                                              Size (bytes):48826
                                              Entropy (8bit):7.97104222446873
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:CB84E51D64C4D8F5C25D1563BC83C49A
                                              SHA1:DAB485EB103DD8810CBBB39F87245B3DB7945308
                                              SHA-256:D916A57D1601286604BF570FA5F88E5A257026EDE1A41F5D305AF24B6315CE05
                                              SHA-512:2120EFF7FBF22BC108DE651BEAAF95CB34FD19E66F940C28B2484ACDF13DCC6F38093C7F20F2C34AF02D5B7E6BEC7F4826FD067A995F1A64CB93D850C31780A4
                                              Malicious:false
                                              Preview:GIF89a..(......,4.<,.4<.D$.,<.D4.<,.4$.,4.D,.<$.4>.F.........!..NETSCAPE2.0.....!.......,......(....P.%..8....'..g.e..k.^'<.TM.v..z..@.0H..*..p.T:.........6..z...xL......^.....k....|.N..[|.d....lt.Z.`.Wa.........Y...tu........~Y....w.....................S.......i......................................b..........I.P.>}..)L...=..y.P...Cdf....@....7.....Em.CzT.r...UNfK...H.6K6...f..C.<&...xa8.A.T..3..E..S..".7..T.YC..[...x.d&.....p.. ...F.x.Y..q.]..0.d.......a..."5.....f...3g.a..<...c..%......._kl..........1b....>\.......-n...]2........^..7...hO........<.u.....cZ...P?.W.h...#.|....hX...f..._w..g...V..b..S....S..S.x..$.hb.s...O.}8E...(#z4.w...M."..Nq.'........G.h.y7n..1U|..e0V..%....^t....\.Y.V.I..a..Ypv&...%_C..&.a"b.o..f...E$6. .....]T(. .0OC].Y..$...9h=.""....#~_........l.i.b.x....:Ef...k.W.i...j ..*j.<...l...C...y.U..B......g.......}...........(\......p@..N.m...1.n.zQ.......1.....S.....\p....].%@...K.w..j..wD...(.........DiEpO$.r.u

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\templatesearch\background.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 640x480, components 3
                                              Category:dropped
                                              Size (bytes):14176
                                              Entropy (8bit):6.839278125838033
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:934A2B6D13554796727B558AFB692641
                                              SHA1:394AE1D2686FC41D6159745A5FA4F3B83346A576
                                              SHA-256:6ED307710D2E815C16E3E15DB60EE6A02337EBCAB6D566DFC56BA4B09E45D6B2
                                              SHA-512:D6B174644B0CA9EA4D2BC799A010639CECE84F037807932644800E3E7545FE67BD86D3C30E674E714DC3E9F5F154246B2988DC0EC85A7F9D042E5C4DD49689EF
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<.....whttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce" xmpMM:DocumentID="xmp.did:C65B25D044E711ECBD2A8C4977CF70C8" xmpMM:InstanceID="xmp.iid:C65B25CF44E711ECBD2A8C4977CF70C8" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57F5A39F0FEC11EB8AD1E9DA0A372097" stRef:documentID="xmp.did:57F5A3A00FEC11EB8AD1E9DA0A372097"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\templatesearch\clearbar_installer.jpg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 640x480, components 3
                                              Category:dropped
                                              Size (bytes):15203
                                              Entropy (8bit):6.664650979709431
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5B6017903932FA5CA55C01D1444AD053
                                              SHA1:BE2B4CF5F2DF4C43794788E9F8B6BE5C62989A03
                                              SHA-256:7348E5936291C90230E2B1E33871B2D20FE83C0863C83A86067C12E0EF6C9906
                                              SHA-512:A463D83F415DA40A273249D9DB79830C52BEBA6848FA27139D6039C4502FC9476B9D1E4A17B19A147DF7DED221B976DD4BB202B03DD78EBAD0AD88D289B5FF4E
                                              Malicious:false
                                              Preview:......Exif..II*.................Ducky.......<.....whttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:924ccc54-ca49-4973-85e7-4f0aef8fb5ce" xmpMM:DocumentID="xmp.did:FB46D150460D11ECBD2A8C4977CF70C8" xmpMM:InstanceID="xmp.iid:E71C9894460911ECBD2A8C4977CF70C8" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D327EC07238A11EB96F6E63C43F39DC6" stRef:documentID="xmp.did:D327EC08238A11EB96F6E63C43F39DC6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\templatesearch\logo-slidedown.gif

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:GIF image data, version 89a, 350 x 115
                                              Category:dropped
                                              Size (bytes):41310
                                              Entropy (8bit):7.9581480738074255
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B79E7935AFCB4E94932E92AA03C78D65
                                              SHA1:5B201539F2DF4EC2BB1BD9DED6925EE3743685B1
                                              SHA-256:D4E421C4E73FF2E5914E7780D1B87557E4D3592568EB3DADF013EA5BA7E92047
                                              SHA-512:A8E07A3D387A5D39CF7F71A1E09A587F034F9C073FE5FDE87F4990DD9ADC528FF7355D78540CD1C7E7729911613E13C3E8C659E262EA09267E798D3540D4FCA4
                                              Malicious:false
                                              Preview:GIF89a^.s........q....................VVV..M..s.X........W.R..p.ki"."!"....T.........zzz..C...........jjj.........._.B......CCC.......l;."...$.&...z.=..............i.g.....{....!..........r.F..p..6..U.....".....z..^....t.......{....;.7......n.v..Be.V@_...............`z.loP.......S.H...@zagK...........^......b.r....w.....^^^...rqrPPP666...WcGd.b5.0..m|.....<.........!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.4 (Macintosh)" xmpMM:InstanceID="xmp.iid:E71C9890460911ECBD2A8C4977CF70C8" xmpMM:DocumentID="xmp.did:E71C9891460911ECBD2A8C4977CF70C8"> <xmpMM:D

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\assets\templatesearch\logo_white.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:PNG image data, 1216 x 288, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):29845
                                              Entropy (8bit):7.893079393545145
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BC74AB6207A210985BE4E8DB050CB39F
                                              SHA1:ACA2C05F1735542ED91C264351CAFD04186FD1B7
                                              SHA-256:9E4A27FB0AFA9CADAEBB836B84C41063CBC8B5CCA0390FDA5560DD07A43E720F
                                              SHA-512:A8E53B66DF6322F267E60A7E96F20F9D205A1E2325463E18E1DD6BD9B7F7A78675A86F7A63D048AFA21F13866062762AB2193D83AFC197848894B7D7CE247D1B
                                              Malicious:false
                                              Preview:.PNG........IHDR....... .....R6......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)" xmp:CreateDate="2016-08-23T17:52:30-07:00" xmp:ModifyDate="2021-11-30T12:28:25-08:00" xmp:MetadataDate="2021-11-30T12:28:25-08:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:dfb16f7c-4eac-4227-915b-e0727b6c6ad8" xmpMM:DocumentID="xmp.did:D327EC04238A11EB96F6E63C43F39DC6" xmpMM:OriginalDo

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\css\baseline-compliant.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):6220
                                              Entropy (8bit):4.789349473219596
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:78D40BDAB40ED79853222569B9AC5BD9
                                              SHA1:F525D229E47F1488ADEF5AAC8BE3795BAFF46707
                                              SHA-256:E9B2E3C37C6463706FBE22925EB0B084AA785E78D49F65136608D9C15CA6C960
                                              SHA-512:20EBD3F197FE64BC3ADCF8325A142396148D51308E8C2CD7E746EF0842A8DCBA29B7B3A37B87C7D471F7A83F63CCAECC2E50B44B63CCDFD1E1433DDDDC989EDC
                                              Malicious:false
                                              Preview:* {.. font-family: "abc", sans-serif;..}..html {.. -ms-transform-origin: 0 0;..}..html,..body {.. padding: 0px;.. margin: 0px;.. overflow: hidden;.. user-select: none;.. -ms-user-select: none;.. width: 640px;.. height: 480px;.. font-size: 13px;..}..h1 {.. font-size: 18px;..}..img {.. -ms-user-drag: none;.. user-drag: none;..}..#root {.. display: block;.. padding: 20px 30px;.. border: 2px solid #e6e6e6;.. position: relative;..}...light {..}..a.complianceLink {.. color: #333;..}..a.complianceLink:hover {.. text-decoration: underline;..}..div.header {.. height: 15px;.. position: relative;.. display: grid;.. grid-template-columns: auto auto;.. justify-content: start;.. align-content: center;.. gap: 5px;.. align-items: center;..}..div.brand-logo,..img.brand-logo {.. width: 225px;.. margin-left: -5px;..}..div.headlines {.. position: absolute;.. top: 35px;.. right: 0px;.. text-align: right;..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\css\baseline.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):4025
                                              Entropy (8bit):4.759644609499465
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4C862C415540662AAB18410305790F9A
                                              SHA1:9EC0F474BE3E7DF193CB633ECA91D111A2F78D9C
                                              SHA-256:085862D788D0DFE742617007AB076333D5C583AF4D179E73825F7718F2B8846D
                                              SHA-512:55960A63BFC2EC25F62AB399CB485CD13BBB67004B1F1B2F20EEDD5F99C14887C1BF8BC1E5441FC87080BCFE6168B72AFB840B4579BE91A7C3D8718A0E563356
                                              Malicious:false
                                              Preview:* {.. font-family: "abc", sans-serif;..}..html {.. -ms-transform-origin: 0 0;..}..html,..body {.. padding: 0px;.. margin: 0px;.. overflow: hidden;.. user-select: none;.. -ms-user-select: none;.. width: 640px;.. height: 480px;.. font-size: 13px;..}..h1 {.. font-size: 18px;..}....img {.. -ms-user-drag: none;.. user-drag: none;..}..#root {.. display: block;.. padding: 20px 30px;..}..div.header {.. height: 60px;.. position: relative;.. color: white;.. margin-bottom: 25px;.. display: inline-block;.. width: 100%;.. align-items: center;.. justify-content: space-between;..}..div.brand-logo,..img.brand-logo {..}....div.headlines {.. position: absolute;.. top: 35px;.. right: 0px;.. text-align: right;..}....div.headlines .title {.. display: inline-block;.. padding-bottom: 4px;..}...headlines .subtitle strong {.. display: inline-block;.. padding-top: 4px;..}...headlines .subtitle img {.. vertical-align:

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\css\baselinenew.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):5869
                                              Entropy (8bit):4.769112559994696
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4D9E4F45F1F8500EB7FE29AC4A34818D
                                              SHA1:0A8F424863B0D7087BF2B5EAA42A0F2521184789
                                              SHA-256:03ED977D9D2B9AEEE7912886185B69BABB7496DC9B45042190097F81153762DC
                                              SHA-512:BCA500F71DFFE5C75A525632D40282886247DBB38010136E8EAA2C464E6DB35E6F1D7CA895169C5DB3BD79A5F6528A4723CBA8D0EBE9415704357F8467783DA1
                                              Malicious:false
                                              Preview:* {.. font-family: "abc", sans-serif;..}..html {.. -ms-transform-origin: 0 0;..}..html,..body {.. padding: 0px;.. margin: 0px;.. overflow: hidden;.. user-select: none;.. -ms-user-select: none;.. width: 640px;.. height: 480px;.. font-size: 13px;..}..h1 {.. font-size: 18px;..}....img {.. -ms-user-drag: none;.. user-drag: none;..}..#root {.. display: block;.. padding: 20px 30px;.. border: 2px solid #e6e6e6;.. position: relative;..}.....light {..}....a.complianceLink {.. color: #333;..}....a.complianceLink:hover {.. text-decoration: underline;..}....div.header {.. height: 15px;.. position: relative;.. display: grid;.. grid-template-columns: auto auto;.. justify-content: start;.. align-content: center;.. gap: 5px;.. align-items: center;..}..div.brand-logo,..img.brand-logo {.. width: 225px;.. margin-left: -5px;..}....div.headlines {.. position: absolute;.. top: 35px;.. right: 0px;.. text-align:

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\css\templatesearch.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):301
                                              Entropy (8bit):4.877013464437603
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D27DFAAFD2D438C9DC0ED0538F973204
                                              SHA1:47617D9094F7BD8025B912512477D485C1E704C4
                                              SHA-256:47F4439CA9AECAD0BE2D735168424EFF04E89BF41CFD2B938D3F9B7E7ECC2876
                                              SHA-512:FFF9AABDB324B8FEE4270DC61B5F40DFCFA282645D612156D79B12ACB8910283940A9C3E077D0CB5C00C13092DC54343CCB3F87A4E92089A06255E63FEFF802A
                                              Malicious:false
                                              Preview:#root {.. background: transparent url("../assets/templatesearch/background.jpg").. no-repeat fixed;.. background-color: #303030;.. box-sizing: border-box;.. width: 100%;.. height: 100%;..}....#root.splash {.. background: #e4f5ff;..}....img.brand-logo {.. width: 250px;..}..

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\index-templatesearch.html

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:HTML document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):7844
                                              Entropy (8bit):3.5083889742064187
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:FFE9531A433A057F9961986FCFD69554
                                              SHA1:1916519CDB223B8B529BCA8DAB235BB2DFC2FC68
                                              SHA-256:6B4202E08709ACBD0B8E4B4B6FF34057C5484E7F547FFA5948AFCB7895CE79FE
                                              SHA-512:BAE2AC51B49474F5045FA0685DB1260350EEC6D5DF63249C265F50FBAECC67D6201BDC267ECB5C2BF1975F3FB541F646F665ECB83A19A2F9506098E9D595F9D4
                                              Malicious:false
                                              Preview:<!DOCTYPE html>..<html>.. <head>.. <title>Installer</title>.. <meta http-equiv="X-UA-Compatible" content="IE=edge" />.. <link rel="stylesheet" href="css/baseline.css" />.. <link rel="stylesheet" href="css/templatesearch.css" />.. <script src="js/knockout.js"></script>.. <script src="js/installer.js"></script>.. </head>.. <body>.. <div.. id="root".. data-bind="event:{.. mousedown:rootMouseDown,.. keydown:rootKeyDown.. }".. >.. <div class="header">.. <img.. class="brand-logo".. src="assets/templatesearch/logo_white.png".. />.. <div class="headlines">.. <div class="title">Template Search by Clear Installer</div>.. <div class="subtitle">.. <img src="assets/common/check_badge.png" />.. <strong>Safe to Install</stron

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\js\installer.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):15307
                                              Entropy (8bit):4.978854437959928
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C0122689D0F116B0C79D58C9962F7F75
                                              SHA1:08D72B5980C597EE06583C13B81C1CFBED7319DA
                                              SHA-256:25565351691900A9DBBFB5D1911132B27CC36A1965FB336E6CD9BA960E37408C
                                              SHA-512:DE9ED34C4EAE926C20B89D0973B6561ADCD1CBE60AE0BBC97C4DCDFB76454BE481BAEA08C5DB0E0E633DD152A3C0FB48C0FB5CF9C6FB68BACF39523B228F4EB5
                                              Malicious:false
                                              Preview:function startDeveloperMode(){.. if(window.developerMode) return;.. var lastMove = new Date().getTime();.. var checkMs = 10000;.. var idleMs = /* 10000; */ 60 * 1000; /* Change 10 to larger value for debugging. */.. (function(){.. function checkActive() {.. var delta = new Date().getTime() - lastMove;.. if(document.visibilityState =='hidden') {.. window.setTimeout(checkActive,checkMs*10);.. return;.. }.. if (delta < idleMs) {.. window.setTimeout(checkActive,checkMs);.. return;.. }.. console.log("Reloading Due to Idle");.. window.location.reload();.. }.. window.setTimeout(checkActive,checkMs);.. document.addEventListener("mousemove",function(){.. lastMove = new Date().getTime();.. });.... })();.. //In Develop Mode we will fake the installation portion .. function FireEvent(cmd,a1,a2

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\html\js\knockout.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:ASCII text, with very long lines (597), with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):68388
                                              Entropy (8bit):5.378476646259453
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:052E3CBD4009F65055D36541CE9CC91D
                                              SHA1:9DC0A7035AFD04236B673389833B6C56AFFD64E2
                                              SHA-256:7EB9DAB1C04D4ABCE6749AD9D94DDD0690E3C99C6890F979F07EFE4775EE1EAB
                                              SHA-512:5260EF11BA932C309C615CAAD7BB063F0A6D1D15376145AB1078C60A9DCA375B2BAF50BC741D31BD01C9B26C857F57EEB3266AE6ECF5E5A6C308E6C2C4739811
                                              Malicious:false
                                              Preview:/*!.. * Knockout JavaScript library v3.5.1.. * (c) The Knockout.js team - http://knockoutjs.com/.. * License: MIT (http://www.opensource.org/licenses/mit-license.php).. */....(function() {(function(n){var A=this||(0,eval)("this"),w=A.document,R=A.navigator,v=A.jQuery,H=A.JSON;v||"undefined"===typeof jQuery||(v=jQuery);(function(n){"function"===typeof define&&define.amd?define(["exports","require"],n):"object"===typeof exports&&"object"===typeof module?n(module.exports||exports):n(A.ko={})})(function(S,T){function K(a,c){return null===a||typeof a in W?a===c:!1}function X(b,c){var d;return function(){d||(d=a.a.setTimeout(function(){d=n;b()},c))}}function Y(b,c){var d;return function(){clearTimeout(d);..d=a.a.setTimeout(b,c)}}function Z(a,c){c&&"change"!==c?"beforeChange"===c?this.pc(a):this.gb(a,c):this.qc(a)}function aa(a,c){null!==c&&c.s&&c.s()}function ba(a,c){var d=this.qd,e=d[r];e.ra||(this.Qb&&this.mb[c]?(d.uc(c,a,this.mb[c]),this.mb[c]=null,--this.Qb):e.I[c]||d.uc(c,a,e.J?{da:a}:d

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\is-0GHSI.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:7-zip archive data, version 0.4
                                              Category:dropped
                                              Size (bytes):8546514
                                              Entropy (8bit):7.999863978630942
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:7DC87223BDC45F03C7C41B8AFF75C6D4
                                              SHA1:BD653C6190EFF7F2679C575E4DCB7F6AC9562F69
                                              SHA-256:EB019BBECEB137AC5BB629E47F7521385340CEE30CBAC95C6E64E62AEED58045
                                              SHA-512:DD9DF6D5CAC4B4334DE38B02966138A8E0123C6011E6EFDE1A9E014D276358747FD9669B45899462DDB3687F1A48F07240194C16796E8D037E240599D940EC40
                                              Malicious:false
                                              Preview:7z..'..._..v.h......&.......<SG.....].4...]:7.U.....M..&....H..-..$w.=S.Fm.1.k,..\...v......&J.>......\....5...;5.......z.....k.".E......}........b..\..).B,.....nL%$>.R..]..`.....k.A@..Xc.y...q...........9.N7..1..+..+.'......BF.8q.n..F.<E...........0....kb<.^.MN?O...-#... .c...G.(L....~....Z..vu...6..........U..]...M...Tn...H2."u.......H...hy.3..E1.]Ty.q..J.>.....p</._m....rLp6K.Ps..._..qs\....p.>..........q..2m....Xs...B...~p./.*.>..c.B.9.M..<.S.-.+N....V.....,..N.x.=9.....t...2!..G..$..[F..sZ&.....ou<.*.~v..&z.KP?..... +.W..S.......FE a...E..g..(.R.|!.E....D.V[}...$Q....g....H...?c...PoE...|)..g.y.8B.....V...>..NmRY..^....(K.....=~J.....I..lQ..#....-.~..Oi.E..\p%.H.rs..b[Bc...sm.v.6.B..M..k.h.$....$.E8.t.......}...}NG...{&..s..eXY?....a...Y.|...)u....vwC.q8.._..D.....S...G.4"#W..5....[D7..T.u"..:Z.t.D.(..9@.O..Xr.."A...[A..rB.J......h.0....?.\.xU&..G..a..,.U4..>...C+1..f<.......F0z.l...=//;...Q/l:"..l...:.X.m..`533.N......y..&EK`....

                                              C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\is-I6UEE.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:7-zip archive data, version 0.4
                                              Category:dropped
                                              Size (bytes):87996149
                                              Entropy (8bit):7.999994042425019
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:0B6FA19DB0B90FD9222867D893CA216B
                                              SHA1:F58F5E07126CD2B51170E537E0544D85C0D0E057
                                              SHA-256:E125ED3D1E0B34FFB9D4442092D614F26FB6CDBCC4194AA514285547F43CECAC
                                              SHA-512:F854FA5CB02358F9D9475582E8DA76B6BF20270B0C864C512196F65818E67019355111B4639A60A27D73E61E7180AC43F0319199DDA1B626D2D8D3E0F3C8470C
                                              Malicious:false
                                              Preview:7z..'....E._..>.....%.........'...L..]...Jxe7.E..o..wq..j..n8....r.....'iu2..S.....Q.:.o...cuq...)g.....NNu.S.C.m.y.w.;.p...K......M.#.~......f....[.~q...t.....s...O.....+`....$.-.u.....P..N [.x.............m]..[i..J6.&..W.....#`...}....^.W.q....J.h.4.W<...L.AX..h.......=.....hc..Q.Q{..4..!..{.,.Ga.E&'.....`.mG:...NX.v.V...6$..........)T...... '.We..D.H.=j...n.......8.H..W1.......%..H.-Y@(5..$7...Ooo...jC.2..OAo .{...........d.....AF..m...P....].%-....".d...S.9..P:.... ...\.1......c....,...[{...Ly...K.)*.e..W..h...a...`.....5........Q.nr.p......Tp../m.P=....W..GQ....;K..}...U.U....p.{.......>m.`..J.1$...&.k.U...C....I..2......4.j...2..l.d.u.....ASk...[.9..$.:..P..3.N.s.l..u.>k...%=...f...n..XLi.y36..._x..2....1.5.....DG...........EB+sS..W@..80.o......'Bn...{.W..t)\..j....S..A....|?..o{.9LX..V?...I..=...Zvx.c..LE.1Lg*...;......U.~...>..p.E.QJ.-.^..H.oc0...{p.~Rb..._.7.3pl....7,-.=....YIs.?.... ..y..9a...qq...h.7.G.Ue......+.%..G..he...+.Y..

                                              C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe
                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Category:modified
                                              Size (bytes):3149872
                                              Entropy (8bit):6.376122605923394
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C76E26901E5B975415817DC6691B10FC
                                              SHA1:D11283E30BFACABF622259C169E0DD7424AA882D
                                              SHA-256:9801DE2908996B63652A917F25CD28DBD3FF3E0A5DD1E872320C2E1B724CCE03
                                              SHA-512:6FC7F516F3D0BECFD2C8F564DAE4C9A6E09A5DC6ABABB1CD6AD0F1E6EFF3A50184BA55C3B91110FC0A621E1C781BF814177A3799A806031121884DCB8F95A9EB
                                              Malicious:true
                                              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................0.....qf0...@......@....................-.......-..9..................../.0(....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\53226739-40a4-40a1-93a3-a1e0cbd442c9.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):529903
                                              Entropy (8bit):7.994583752679744
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:C914B2B6CD83E8B43DCC3C754B7F5E1B
                                              SHA1:7C1515523D90F2A9ED1A1DE6EDEED3B2C8AE964C
                                              SHA-256:A45E71A9551968C33E3222179B08ACCCCDFC55029A9C77CC5D5842D7ED34BAD0
                                              SHA-512:F5F4379CFE6FE341BC508215EAE9ECCFC4305B01CCA2099DD7B50F335AADCE23B7B13E0B38F6FBE4FD926BEFAEF1AD811DBD8B9EDB0010F9EFA56BE5559DF709
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a.....k..#....+.X...e .W..FU..",.e.|.....L.....5U...9.......@.8.i=I.."k....h\...`.PF............`O..h......R.........q...........+g...k...L..1.d..k`b.21..b"`..H..>.K.?.j.5dP.....p.s....F)........}.1..t..;.`."3*.PK........t.EU................icons/PK........t.EU................icons/128.png.'@..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.\}..H.,.Y_-...I..I.9!.0".....0"....E..F..................|...p....2...p...|....2\...0.n..{x...0|..._x.......}.._...u.....0<......\O..1.W~..>...#..p.../..$.%......m..yQ...p...p:.7.........8\.....~....\.p./O'.^..?..4....4\.oy.i...?O.M.../......_..x..q.r...g...v._|}._...v......'}9.'%.....|.g..'y...........%..._y?.a.....R..v......o.|...4....q....4~....y..4.....|.qG..}}...N..p.....4\..........".o.;..9.=.kow......Y.a...z.n..{q...v.....i_..KJ{Ty..........g....*.}..8...vm.....wW....>?.=.i.z.U..q.!...=....)..D.'..0..U.......e..m...}.f...E...W..P..g.+..R..J.u.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\icons\128.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):23093
                                              Entropy (8bit):7.97805846599321
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B28DDEFB5797C246D4D47DEB9A9D00A6
                                              SHA1:3148B92EEBA4966C86655E6BE38692ACBF25353B
                                              SHA-256:B805C307938946044619FC2F8C3D251A476153C3BE36FB02B0EF43F70CBB1675
                                              SHA-512:89569772337588BF201AABC0D765BB8888D3C0C51BE78C27D1FF91E090A490850021AED0FFBC28F42A3B720959781E3B7569BF904F7E3C5B7E861FEF047F3D73
                                              Malicious:false
                                              Preview:.PNG........IHDR..............>a... .IDATx...n[v...c~...{.s.v...'@$@...%.F..^zT3..=D+./@iA.......K.......S.N.(..Q.o.$....w..=hl.B.R..d]..5...s..g..?...!.V/~....n..?7...2&..7.sb...w.W<."<..~.......3r`..I..A..C6.p........r.......L.2>|A~.c..u. .NX8...X.m..X.V.....@.q.'..S...Rh... .A..=.4[...ccp0.....8J...F...[.X].r!?v>.......:o........{...~.3!...k...6..^N...M.u.(........u...v.v'N.........t'e...|./.... ,.T.Z....Y.......6...X.T.....#7.....N....RQ6....?.,.....J.4.5..S.q5..twa0.........<..Bw....i..0B 1.^.,jW.w...A.../2....?.....>...H.^.E....z..M.?O....!.. .w...SB..B...6.L..N.Y...*.7)..2..i+."v'......sF,/.t8<K.K.kN....b.gt...X ..f..Ht\YLgX..9....S!t%l..<w............E...J..9..)..../..;+z.....RFq8.D...p}C.......F....{../}...1.... .0MYt...C..P..Z...q@q.8.q...s....3....GE.s.'o..."....o.......7..m".#.D....E`....R.1M.A...P...[J.'7..n./.5..oiK9.d=-.Q4.jWn"..ig{.0.r......*.^........O.......'..P...0..x.,..h@b.O_._.N...c9jm,.......B..F...2R=..7;y.B..

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\icons\16.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):691
                                              Entropy (8bit):7.633391871464149
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E24AB960F0846B959343DFAFE2643C5E
                                              SHA1:3D71CA5C8E8BACE9B41F5F3FF64ADB02EE684D7F
                                              SHA-256:0BF1568FA028B903F08859217B891318A3957083F4B60058CCD26C4D872E52DC
                                              SHA-512:5013E980618654701E2C64089EE108A92D3FC2506D4465D6B770C000090A921C492C20B0F7FE70FCCAD51FC5D0E15C3EF3906DE6DDD1F11AAF59C8A25F6BEA25
                                              Malicious:false
                                              Preview:.PNG........IHDR................a...zIDAT8.}.Mr[E.E.._....U.@c..U..abg.. . . ....x...O.(".;..-AV$..~....I......+....z..u..s..!.4......Z.8,....m..GA0.O.%.R....`.9....N.H....O.s......}.g.......G~....}..@M.(.,......-rq...p..4.Q...f0.......X..\..z#_~..o.^.:...|9R..4Ul5..h-.{...YN.`TD.~.T..Gg....s.U)..T..L..\...:3(M6..M....i)O....3.<..`.BM...t.b..Q.......BQ=-jT...P..J.4Ro1...B..)..Ff.....X.*.B...;.x .*1g..q.3...D.P..`.t.LL..=z.@lG!.[.f.]7#D..).....pC......K....AC.(...l....j...O.T..Z.-..iy&......._\...V.].{I/.\..`....f\jd*"Bk...hC..<g...Vo7o......=......*..$..i.I..KH.]...n.......\O.:.0O..g.R..{...3/N..1.D.O....T.$...O...w.-.%.T...G.)=.s...e>..+M.8.>....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\icons\32.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1957
                                              Entropy (8bit):7.884321077926407
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:42D444628DDFB44F280AF8E3D3D91D06
                                              SHA1:F9FE9CA5586A15E43F8AE3C83EEC3A2F006BE936
                                              SHA-256:256C9EF9D4827596540ED6B71FA327EBF68FD9A577DB094AD116472A5DAB448D
                                              SHA-512:37C36D5C043AB2C84D18FE73277F398A1FF4E4B51B89274C5A571885D2786611B15D416FEBE84A5274AE38658D550EE9A43DF3B3725892731E2042DAD385255A
                                              Malicious:false
                                              Preview:.PNG........IHDR... ... .....szz....lIDATX....e7u.?IsIZ{..c.*..T..R.].@C.]........$.. .........!>U........{.%iJ.....S..3nt.$.1........'7..7........*(.......fc;l(.p......r......_....c..............5..`.)MLj...N..9....+)L.:2C^...5,).wnoo.D..L@.v.cx.(..Dh..;...;....$.pR....."*.).AY.fG.......1...2.Xx..<h._.......N.!............I.x...z.........9.r!...G.z.........._.+.#+.S.........i./8...>.......v.{].u.......n.r.mp....Og.5.?c..6&.u.....~.y..S...R@...&.b.W..x.{....o_|..~..U..H..g|.RU.2.D.|.H....L..=..e.d.>U\v.....2H.H........-.."...,.W...l.M;.[........-...m=.G&..;...~.M..&.7.G.Gh.....vZ.e.T.S..=..tZ.....{L....<n...3....z...r.`,.n......wC..=.Fr.F.;......e.Yg.p.a..@.......0^...hf......z.......o.../.....F.{.nn..w_q...U.8&7.{e....]....y.Vd.@.w.d.1OY+.+.......hw...\EL.....fl...xE...S..v.}...$..>"}.....#ab...Mh_(.@.....At.c...3K.d.8...hXT....v...8..n;.&ClG..i1#..gj...U..zRM.7..B..0.@..M)*.?3.F.....*.*C....,....Rm.v.....K-.../h.l-pL.QErD,....v...c./....K...j

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\icons\48.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3785
                                              Entropy (8bit):7.941984412952849
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D48A30D2B8D19A798BD75604079B521D
                                              SHA1:97A091418EEE18181DE54AD7B4A099D32A7EE75A
                                              SHA-256:64D5AD0AEEB7D0B43167F9391FFD1C324A0746702727DB3F277DC8F7FEC97E0C
                                              SHA-512:45AD08DBC7A445A7C9FFE34001286BC621DBE138CE54FC1337B85AD34B44DE178F09E07482A59EDBC68057D2812D9350FF48A836798AB86D993A6F6395D6A8A4
                                              Malicious:false
                                              Preview:.PNG........IHDR...0...0.....W.......IDATh....-iU..o|.Us... .... ...........+@.@8.P......Q.M....`..k.Y......d...v.=.T..5..?......7...mpB..z w....H..N!........P..'.R..Zq.JN...n#...|LH.....=..y...O..]....=.....!......@Rd...7,.".*..#..#.5.n...gc..m...`..F.Vv.p|.<L...E...o........-..v.2....:N"..).p..C,}v.&.N.:..1......b..c...h'f![a..I'.h..8..f...WO|.r.........f.a. 7.=?.....Y.m...,Y.U..S'+.{_9u.>M..F.Q.a...?`]...`..m.,...@.....g..y..k!^'p..K..J..........|.x...S....9..W.8.L.,v...%...H=Q....\..N.+c]i...../..A[...9.~..z..@.@...[r........)<i...W.P.....0.._v........#.]..J..Y.v]..z*_&\.HU.b........3z..-3zz.q~"z..E..3......B..N....<~.8...`.^.5.<x......m....$..n.r.....3..#Hf..+.F...+...:.Lj...TY`lX.y$".W,U.........Uf.T.jA.z....2.....g..w.Y.._w..h......qy*.g.L...:.....Lh.G.yJf....}.N.e...v.].{.z.7.*....<;.8j..o V.Y......P'..V.!.Xs...1..d$P....:.{S........;.M."..qj)j.e.%.g.....,..[..ec....h^.fPgg.........3.k'A-.x...Q1...J0.....F7..\..o...2vf...i:yM.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\lib\ext.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):8217
                                              Entropy (8bit):4.09797315130954
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C0F2C9AF55CFC9B5B9C917A7A132B602
                                              SHA1:9FB8E67752B1D0ED0094DB194B70EA974B9F2DF8
                                              SHA-256:F51D69389B3DE4FE798924193A1B17652F5D59ECDC172B6465C09C2E8DBB25BC
                                              SHA-512:22D74FC0D0D508D643E208E7C8EA60BA92CF6908CEC370B7AE949338F58C8C58421560F174A5808209731EC050872A5EC19EF760CF4026289DB46B13ABEA1F5D
                                              Malicious:false
                                              Preview:// Extension Class..function extension() {. const NT_COOKIE_NAME = "newtab_path";. const CONFIG_COOKIE_NAME = "ext_config";. const TY_COOKIE_NAME = "ty_url";. const NT_PAGE_PATH = "/newtab/index.html?direct=true";.. const init = config => {. this.config = config;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].get([name], ret => {. resolve(ret[name]);. });. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.error(e);. re

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\lib\tabs.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):691
                                              Entropy (8bit):4.124013726992776
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:36E648CE8261BE88326559D60531AC1B
                                              SHA1:67E0574A45A6F4DDDC01EAAC885E3BC3B5E4BF8F
                                              SHA-256:22DA282A8B25C211687256E6C8EEE07856CFF90F8AA99A36DBD10A10D0FB2A09
                                              SHA-512:1C0F28CD24B3EE72C6C09422A9018807DFA2D565D4561806A7C09553565F26055F28DB72E920A2B36CB8A2EF6D0728CE9B38E40D00D31F03E675D0B3355D641C
                                              Malicious:false
                                              Preview:function TabListener(ext) {. const onActivated = async activeInfo => {. activeTabId = activeInfo.tabId;. const tabs = await chrome.tabs.query({. currentWindow: true,. });. if (tabs && tabs.length) {. const tab = tabs.filter(t => t.id == activeTabId)[0];. if (tab) {. if (. tab.url.indexOf("http://") !== -1 ||. tab.url.indexOf("https://") !== -1. ) {. await ext.setSetting("lastActive", activeTabId);. }. }. }. };. return {. onActivated,. };.}..// Generated at Wed, 05 Oct 2022 20:43:41 GMT.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\lib\util.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):2787
                                              Entropy (8bit):3.751169810210959
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7A411ED713C5C77F89051206775F943C
                                              SHA1:B5F41B14E81FEBB8C14D9C79F4FE8E7046ACC2C4
                                              SHA-256:9C56C5DDDBE052A9954C829A2F5F0FC71C8AC66FB943077F2982493CDA7E0F44
                                              SHA-512:4AF5BC5AD3907C8CFE0A66102D09570AF5B1886F7637D7971414F71272FD7D74B9DA8835F674CF256550603707BDA698CA2C04E2F6E8D156EDA50777BAEC9AE8
                                              Malicious:false
                                              Preview:async function getCurrentHistory(full = false) {. const list = [];. const tabs = await chrome.tabs.query({});. if (tabs && Array.isArray(tabs) && tabs.length > 0) {. tabs.forEach(item => {. let item_url;. if (item.url) item_url = new URL(item.url);. if (. item_url &&. (item_url.protocol == "http:" ||. item_url.protocol == "https:") &&. item.title !== "". ) {. list.push({. url: item.url,. type: "tab",. title: item.title,. favicon: `https://www.google.com/s2/favicons?domain=${item.url}`,. data: item,. });. }. });. }.. let historyCount = full ? 50 : 5;. const history = await chrome.history.search({. maxResults: historyCount,. text: "",. });. if (history && Array.isArray(history) && history.length >

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\manifest.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):1110
                                              Entropy (8bit):5.1303950657400454
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C720A51C073F29C24EDC35CCB0B65061
                                              SHA1:387483DE18EA6D962680002346AD2FF9F2EEE2ED
                                              SHA-256:47F58922704398B376E6112E82C79CD91C8A8BEA8D2892009FFF4399E664B4D2
                                              SHA-512:5E0350C541462B2A950CDF1EACD5A5FD9489142236AE33640B09F8DB148E8A00C3C1C302D9069D22D4BEB3379B285D91F749EFFE1AEA9B79E4C6C4F25EDDE9FF
                                              Malicious:false
                                              Preview:{.. "action": {.. "default_icon": {.. "128": "icons/128.png",.. "16": "icons/16.png",.. "32": "icons/32.png",.. "48": "icons/48.png".. },.. "default_title": "Easy Print".. },.. "background": {.. "service_worker": "worker.js".. },.. "description": "Easy Print extension provides a way to print and modify page content of open tabs from your browser.",.. "host_permissions": [ "\u003Call_urls>" ],.. "icons": {.. "128": "icons/128.png",.. "16": "icons/16.png",.. "32": "icons/32.png",.. "48": "icons/48.png".. },.. "key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAK6LvtVrs9ojn8aQ1forv1jKCcBlIBpX4/hGVZXYIiyZZQt8pQb3tRpM0YMYrJKXNVWOE5o5mc7Ng6/0rdBA4LQ4j2k9SYbyuJkia93x5/FoXNiY2Q1gxlBGuP2Sg9KfuwIDAQAB",.. "manifest_version": 3,.. "name": "Easy Print",.. "permissions": [ "tabs", "history", "storage", "cookies", "scripting" ],.. "short_name": "EasyPrint",.. "version": "1.22.718",.. "web_accessible_resources"

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\check.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):406
                                              Entropy (8bit):4.784110171206858
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:30416E3C609548DCF8F6F7BABFB93FD5
                                              SHA1:3668AC6DB860C8CED56E52BFE16EB1961DD78829
                                              SHA-256:BF98F2F6F75C6A0C9FFAD794CC5782ED571E1D3CD73CCE2F46B3E611868FFF0F
                                              SHA-512:83F0E3516F957DBF2864508B775E7642D3BE54A21A2F82201045695AEFC72688950C2BFFA5726E5DB9F8CF923A9B3B346CC77E34B20F80DAB8D276A04A8CF142
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M191.47,49.4l-16.13-15.13c-5.24-5.24-13.91-5.24-19.35,0L83.44,106.82c-2.42,2.42-6.25,2.42-8.67,0l-29.42-29.63c-5.24-5.24-13.91-5.24-19.35,0l-16.13,17.13c-5.24,5.24-5.24,13.91,0,19.35l58.66,58.66c5.24,5.24,13.91,5.24,19.35,0l103.59-103.59c5.44-5.44,5.44-14.11,0-19.35h0Z" fill="#222"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\close.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):808
                                              Entropy (8bit):4.663957285139542
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:359A26A7AFF877DC5727EDFBD007A176
                                              SHA1:E9F9C0844B0B24CD3AB8891CC656951297E1C02D
                                              SHA-256:E13BD129F85CFAC14FD242248B436E26AF214C4B6AC0A41B59ADFDAF021A04D0
                                              SHA-512:0DE0EEAC96EB2A4D1657D0A09CEEF54AB51FCC8D1C381B7C9C5412A5F0FFE00E9DDA384FCB46647F6F33615AA8CBE8AFA042DE6F3299FF497F1DB582CB5690D6
                                              Malicious:false
                                              Preview:<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 454.0118 454.0118"><defs><style>.cls-1{fill-rule:evenodd;}</style></defs><path class="cls-1" d="M255.5858,29C130.2936,29,28.58,130.7138,28.58,256.0059S130.2936,483.0118,255.5858,483.0118,482.5917,381.298,482.5917,256.0059,380.878,29,255.5858,29Zm0,30.2675c108.5845,0,196.7385,88.1539,196.7385,196.7384S364.17,452.7444,255.5858,452.7444,58.8473,364.5905,58.8473,256.0059,147.0013,59.2675,255.5858,59.2675Zm0,175.3393L202.073,181.094a15.1314,15.1314,0,1,0-21.3991,21.399l53.5128,53.5129-53.5128,53.5129a15.1314,15.1314,0,1,0,21.3991,21.399l53.5128-53.5128,53.5128,53.5128a15.1314,15.1314,0,0,0,21.3991-21.399l-53.5128-53.5129,53.5128-53.5129a15.1314,15.1314,0,0,0-21.3991-21.399Z" transform="translate(-28.5799 -29)"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\highlight.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):377
                                              Entropy (8bit):5.000825262981631
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:93147DF595140BA8BBEC309DE495FD0C
                                              SHA1:66C6D8652B3B940EB26C50DB8B34058F9F8453FB
                                              SHA-256:155EB3A0CA0D6B730CD882C7646747DF5198EA919EF8911F1118F5F90E8833A9
                                              SHA-512:940F12F8201F198AD83EF9F9159584BE121CC1CED28F8207504584C4853B77C0F02605F4808346CFC31E871BEAD1269063B80B9F8573A540F4090DC89378F32B
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M99.1,139.71l-32.33-33.1L141.44,31.94c9.24-9.24,23.86-9.24,32.33,0,9.24,9.24,9.24,23.86,0,32.33l-74.67,75.44Z" fill="#f0b718"/><path d="M88.32,150.49l-21.55,21.55-16.17-5.39-8.47,5.39h-15.4l12.32-16.17-5.39-16.17,22.32-21.55,32.33,32.33Z" fill="#f0b718"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\icon.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):3403
                                              Entropy (8bit):5.169292209409525
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5F431CE5D8E8718429BA36B10EE8F40A
                                              SHA1:5E8E6E590AC9BE20B6BB6DD62BC81215AFF2EDC8
                                              SHA-256:EF17717167B534E5DAC2347927D423DAF78424196BBD8E38280EA1E7E7664A0B
                                              SHA-512:5DCFD2C1AFB0EC8D7F0FCF215BE87968D034E95A02D6D757E4180AEC82E30A2987FBF25D1B22C45F7D085EC90F9969F13E8D7A15451EADE45CF2440B90EC2F2C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 26.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="a" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 181.4 185.5" style="enable-background:new 0 0 181.4 185.5;" xml:space="preserve">.<style type="text/css">...st0{clip-path:url(#SVGID_00000165230676972319971000000012373463076411936144_);}...st1{fill:#00AEEF;}...st2{fill:#EC008C;}...st3{fill:#0BD89E;}...st4{fill:#231F20;}...st5{fill:#1D1D1B;}...st6{fill:#FFFFFF;}.</style>.<g>..<defs>...<path id="SVGID_1_" d="M148.7,32.7C132.9,16.9,111.9,8.2,89.5,8.2s-43.4,8.7-59.2,24.5C14.6,48.5,5.8,69.5,5.8,91.9....s8.7,43.4,24.5,59.2c15.8,15.8,36.8,24.5,59.2,24.5s43.4-8.7,59.2-24.5c15.8-15.8,24.5-36.8,24.5-59.2S164.5,48.5,148.7,32.7....L148.7,32.7z"/>..</defs>..<clipPath id="SVGID_00000090287293046097779350000009223030268153988775_">...<use xlink:href="#SVGID_1_" style="overflow:visible

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\imgs.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1014
                                              Entropy (8bit):4.385455446095002
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:61E0D417CEB84B12C95B335199926811
                                              SHA1:CEC6FC449CCB66BBB6EBFC64E9EDA99894DC9371
                                              SHA-256:9E82524765FA9DECA8C95F896FF1ACC28A758CA89F2E9FF2F274BCAB0B1751DD
                                              SHA-512:5C9315D84F9DAA2611D6540FCCC150CBA4B24E8C6DDBEDE2DDDF07B58DED7F766BF2FB3211B2B6972CFC8815898E56C0826F9C975181A942708593C678EEFB48
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M34.79,176.56c-6.31,0-11.45-5.14-11.45-11.45V31.5c0-6.31,5.14-11.45,11.45-11.45H168.39c6.31,0,11.45,5.14,11.45,11.45V165.11c0,6.31-5.14,11.45-11.45,11.45H34.79Zm4.77-13.35h124.06c1.58,0,2.87-1.29,2.87-2.87v-13.54l-34.23-34.23c-.54-.54-1.26-.84-2.03-.84s-1.49,.3-2.03,.84c0,0-22.98,22.98-28.05,28.06-3,3-5.5,4.33-8.1,4.33-2.6,0-5.09-1.34-8.09-4.33l-8.97-8.97c-.54-.54-1.26-.84-2.03-.84s-1.49,.3-2.03,.84l-31.54,31.54c.05,0,.1,0,.15,0Zm0-129.8c-1.58,0-2.87,1.29-2.87,2.87v110.76l28.19-28.19c2.16-2.17,5.04-3.36,8.09-3.36s5.93,1.19,8.09,3.36l10.99,10.99,30.08-30.07c2.16-2.17,5.04-3.36,8.09-3.36s5.93,1.19,8.09,3.36l28.16,28.15V36.28c0-1.58-1.29-2.87-2.87-2.87H39.56Zm33.19,58.32c-11.34,0-20.57-9.61-20.57-21.41s9.23-21.41,20.57-21.41,20.57,9.61,20.57,21.41-9.23,21.41-20.57,21.41Zm0-29.27c-4.1,0-7.43,3.52-7.43,7.85s3.33,7.85,7.43,7.85,7.43-3.52,7.43-7.85-3.33-7.85-7.43-7.85Z" fill="#0

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\logo333.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):3526
                                              Entropy (8bit):4.7065010997514145
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:1A56307B1D61422A570FCFA9250A7E22
                                              SHA1:4E35086E8AE977D3BB8EC5DB2942EE4D4DA7FB04
                                              SHA-256:3CFB99D9AF9BEFD6C99A6D825DBDB3327A999E77469CBA21A937EA6391729497
                                              SHA-512:0AC8FA6569830FDC3BAB0EC57A7959454B1E1E1D24B11410E754A3F5231E8F33DD614FD5C6F5F20486565493BF28783E655C241A1B2474C085F65207B5EC44CD
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 270.53 78.46"><defs><style>.c{fill:url(#b);}.d{fill:#00aeef;}.e{fill:#ec008c;}.f{fill:#333;}.g{fill:#0ac08d;}</style><radialGradient id="b" cx="201.72" cy="53.06" fx="201.72" fy="53.06" r="4.67" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".57" stop-color="#130c0e"/><stop offset=".8" stop-color="#130c0e"/><stop offset="1" stop-color="#130c0e"/></radialGradient></defs><g><path d="M34.16,58.09H12.79V10.68h21.37v7.62h-12.55v11.29h11.64v7.65h-11.64v13.13h12.55v7.72Z" fill="#333"/><path d="M58.26,58.09l-1.72-4.93h-.19c-1.28,2.12-2.59,3.58-3.96,4.38-1.36,.8-3.08,1.2-5.16,1.2-2.66,0-4.75-.99-6.28-2.98-1.52-1.99-2.29-4.76-2.29-8.3,0-3.81,1.04-6.63,3.13-8.48s5.21-2.87,9.36-3.06l4.8-.2v-2.59c0-3.37-1.46-5.06-4.38-5.06-2.16,0-4.65,.84-7.46,2.53l-2.98-5.97c3.59-2.27,7.49-3.41,11.71-3.41,3.83,0,6.74,1.1,8.74,3.29,2,

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\minus.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):201
                                              Entropy (8bit):4.972520869558451
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:4F42E78A25D43F5B5C2661A0D481B0B4
                                              SHA1:F497A3403E9BFC4EE399461B55D477EDD9177292
                                              SHA-256:CD7A72CE1D13A533404469E6E73C0D59171E71F757046FA09A95226ED4D605D0
                                              SHA-512:DAC76BEFAF4CCEAEB0F6CD2D694C6F28FE75EAFE233FA96FD07EF499FA9F40D549A11C6216844132D9AF07E3BD631A8AA56BD6D19E159CDB7D9480B07DCF1704
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><rect x="3.14" y="75.14" width="191.84" height="51.18" rx="8.45" ry="8.45" fill="#222"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\nopage.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 662 x 432, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):402221
                                              Entropy (8bit):7.994300422419648
                                              Encrypted:true
                                              SSDEEP:
                                              MD5:66E74D8B6242BBC4B17AC7A61EF7D2B7
                                              SHA1:9759F92AF59F1A24636FC8647A207EAF444B071D
                                              SHA-256:66112206A8EE298090E9A724411E8B5C89350E07ECA0D7C8E3B5C0EB1D7FF966
                                              SHA-512:FD4E62A93DEC476FCC8EA1CEA0A4F0075D8ED4659048C4D2C475C52FEF0A686086FDD7D025A13080393D0229896B09BE86F3704A38FE64AE0BDB46DE905BAD8E
                                              Malicious:false
                                              Preview:.PNG........IHDR...............%.....pHYs..........{Rk.. .IDATx.t}.d.nl....L.I4...)iZ..P@.\6....;.d@}|..||.|.....................Y....................._..??>~.>>>.?......}}....t...........7...?.\N...........o........._........C.|a...O.......?t&....7.F{./............|.........?..D?>.~k..{...w.vR...z~.../...{..?u..._.......(........o<.k.}~...Bu~.?./...D......~q........~.l..|...Q.S.5-q.\.............w.^.......>~.`.................o........Z.=|.y.p.<..&)..#......z?..k.~k. <.N...3.}.._../.7?o:...)..zD...o}f.R...q..&5-...[...$..!.."J.@...@.`._.......o.o..<C.QG..}..|n.Y.....vW.O./......1....~.7..O/.Z2..[.....z~>>..n^m}J'W........wh..K.7t(Y...G......qF....."."./../...}}.pK.....Op.hTr.h.~.A)....{.....<...7C..i.%!..Z.)....9.y....l.......>.*U.al.n...Q.ou...J..2.K6.||}S>s..VE.......L..K.......#../$Nt..'.Q.".I;.|.3z?....w}.....<W:T.S......5a...........V.B...P.S...../R;H.4D9......\O...S.Q2....P..*b...*.[...../....]^.TW..S.r.oz]..=./t.....v..7..

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\original.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):1004
                                              Entropy (8bit):4.8282172243197135
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:17F49402E7A6526AB0E3CC5C39D5CDFA
                                              SHA1:482ED2BFF9290AE922546206CB83DE39334B09AB
                                              SHA-256:0411DBCDE1D5DC5702E0EA1E35D3F3D37CBA71942439BE674AE1DFDD003A5AFC
                                              SHA-512:83870388892C49F898D0A625DCBABB8E76D126A155C514D631073D707293BF957652423DCC665A73B49C96390B6C20EA7FE07429118391C0E1E36DBE64B77C91
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><rect x="11.19" y="43.93" width="177.9" height="27.59" rx="2.41" ry="2.41" fill="rgba(77,162,193,.9)"/><path d="M20.9,185.5c-9.53,0-17.28-7.75-17.28-17.28V51.28c0-9.37,7.91-17.28,17.28-17.28H178.93c9.37,0,17.28,7.91,17.28,17.28v116.94c0,9.53-7.75,17.28-17.28,17.28H20.9Zm-5.52-17.28c0,2.66,2.11,5.52,5.52,5.52H179.06c1.32-.04,2.66-.65,3.7-1.69,1.07-1.07,1.69-2.47,1.69-3.83V74.25H15.38v93.97ZM184.45,62.49v-11.21c0-2.66-2.11-5.52-5.52-5.52H20.9c-2.84,0-5.52,2.68-5.52,5.52v11.21H184.45Z" fill="#1a87b0"/><path d="M75.59,113.97c-3.46,0-5.88-2.42-5.88-5.88s2.42-5.88,5.88-5.88h85.7c3.57,0,6.27,2.53,6.27,5.88s-2.42,5.88-5.88,5.88H75.59Z" fill="#1a87b0"/><path d="M75.59,146.09c-3.46,0-5.88-2.42-5.88-5.88s2.42-5.88,5.88-5.88h85.7c3.57,0,6.27,2.53,6.27,5.88s-2.42,5.88-5.88,5.88H75.59Z" fill="#1a87b0"/><rect x="26.45" y="101.6" width="29.84" height="44.68" rx="3.14" ry="3.14" fill="#4da2c1"/></

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\plus.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):337
                                              Entropy (8bit):5.04057552763049
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3918F883E450EA44534E07FF3AE3EB8D
                                              SHA1:25EA64C35EBE2A8538584FDDF6C591F0B099B6F3
                                              SHA-256:67CBB0B0812DB335B708718F874A02B0710ED155D8CF09DDCE3CD99CF6B25C11
                                              SHA-512:20960E734864DDFAFE2C086AF86E8CE4DFCCB57E9DF162BF77BADC7CB1F6B82162877CA3647F0A44493D0B7876D200074CF5B2710755B40208125379B402A90C
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><rect x="3.57" y="74.67" width="191.84" height="51.18" rx="8.45" ry="8.45" fill="#222"/><rect x="2.55" y="74.67" width="191.84" height="51.18" rx="8.45" ry="8.45" transform="translate(-1.79 198.72) rotate(-90)" fill="#222"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\printer.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):854
                                              Entropy (8bit):4.867628927782406
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:546812448AECB623C6E563983CBF69F9
                                              SHA1:D659FF0DE5320BD4435060390FF72182E489A87E
                                              SHA-256:12892D1B11581D04B716A0A6B082A2E6769AF892FE5CE96A8D42F4AB466FCEAD
                                              SHA-512:A61AD7D9EE792DC9F53C2479D76E358BE8A3DF2CFD2EF6016015629BCCD687234ACBDA9AE4D7D389E09448E96E993449DB7B66750897AF9A26E5D69497C985FE
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 103.66 88.74"><path d="M77.65,49.85H26.44c-2.25,0-4.08,1.81-4.08,4.05v28.68c0,2.24,1.83,4.05,4.08,4.05h51.22c2.25,0,4.08-1.81,4.08-4.05v-28.68c0-2.24-1.83-4.05-4.08-4.05Zm-3.54,29.18H29.64v-22.23h44.47v22.23Z" fill="#fff"/><rect x="33.43" y="70.71" width="37.06" height="3.43" rx="1.37" ry="1.37" fill="#fff"/><rect x="33.37" y="62.2" width="37.06" height="3.43" rx="1.37" ry="1.37" fill="#fff"/><path d="M90.46,21.72h-8.55V6.46c0-2.31-1.87-4.18-4.18-4.18H25.33c-2.31,0-4.18,1.87-4.18,4.18v15.27h-7.87c-5.31,0-9.61,4.3-9.61,9.61v30.79c0,5.31,4.3,9.61,9.61,9.61h4.48v-20.08c0-2.44,1.98-6.42,4.42-6.42h59.53c2.44,0,4.42,3.98,4.42,6.42v20.08h4.32c5.31,0,9.61-4.3,9.61-9.61V31.34c0-5.31-4.3-9.61-9.61-9.61Zm-16.34,0H28.61V9.44h45.51v12.28Z" fill="#fff"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\images\size.svg

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:SVG Scalable Vector Graphics image
                                              Category:dropped
                                              Size (bytes):570
                                              Entropy (8bit):4.775747367658967
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:D2DD373A79E0834FDFD91DAEB418A5E0
                                              SHA1:5DEA1ABB27B82512E09CEC3C3A8683D85B44B40F
                                              SHA-256:D2577BAA6AAFD1D875331D42595503E0BDEC900199D6092BB598340277572676
                                              SHA-512:A6DE5E5B577AE0335981283C6987B0D7310CF0303DB292518C096092268778DDC7065441C6805594D1BEAB2812328B370EF81D228B1318C732C41B1815472CD8
                                              Malicious:false
                                              Preview:<?xml version="1.0" encoding="UTF-8"?><svg id="a" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><path d="M93.05,137.38l-7.13-23.41H50.05l-7.13,23.41H20.45L55.17,38.62h25.5l34.85,98.77h-22.47Zm-12.11-40.91c-6.59-21.21-10.31-33.21-11.13-35.99-.83-2.78-1.42-4.98-1.78-6.59-1.48,5.74-5.72,19.94-12.72,42.59h25.63Z" fill="#009dd7"/><path d="M168.18,137.38l-4.83-15.87h-24.31l-4.83,15.87h-15.23l23.54-66.96h17.29l23.63,66.96h-15.23Zm-8.21-27.73c-4.47-14.38-6.99-22.52-7.55-24.4-.56-1.89-.97-3.38-1.21-4.47-1,3.89-3.88,13.52-8.62,28.87h17.38Z" fill="#009dd7"/></svg>

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\loader.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):1072
                                              Entropy (8bit):4.6725653435436465
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:9B5AF5D4D28142246D1A7CF7D26E8861
                                              SHA1:23C73626985D430519CC5D122B3B23595CF300B3
                                              SHA-256:432B924189F1540EBF0E8D2D79D80932D1D35D132FA150F889938DCC283F8D5E
                                              SHA-512:3FD940F25D937B43403B2BE78D71499926FC704238F47F1E70CD9392B9159D0C576DA6C55B2590FC208D9F46E6FEDF3D0E250E02319AE44083415B2EC54C0950
                                              Malicious:false
                                              Preview:(async () => {. const setSetting = async (name, value) =>. new Promise((resolve, reject) => {. chrome.storage.local.set({ [name]: value }, resolve);. });. const setArticle = async (name, value) => {. let list = await chrome.storage.local.get("ArticleList");. if (!list || Object.keys(list).length == 0) list = {};. list[name] = value;. await setSetting("ArticleList", list);. };. if (!Readability) {. alert("Readability library is not loaded, please try again.");. return;. }. const documentClone = document.cloneNode(true);. const article = new Readability(documentClone).parse();. if (!article) {. alert("Could not read site's content for reader mode.");. window.location = window.location.href;. return;. }.. await setArticle(window.location.href, article);. window.location = `${chrome.runtime.getURL(. "/pages/reader/index.html". )}?url=${encodeURIComponent(window

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\runPrint.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):287
                                              Entropy (8bit):4.956209825824677
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:07144837A11F047E9BB456D1E758BE59
                                              SHA1:28EC3390740FDF0BEC3773F60CB01E3E829808DA
                                              SHA-256:F4175C36FD3816167A26978386777A71BD51D3C957F661E2B394854161C25F2D
                                              SHA-512:574A07F5E36304B3CF2D7EEF3BF4741067E42F98812FC09DC8856A2A7D4AC28CD48B8FBBFA06EF37811570E956C6B420B0E71A4F6AD41EB01856759B4708AFFA
                                              Malicious:false
                                              Preview:if (document.readyState === "complete") {. window.print();.}.let check = true;.document.addEventListener("DOMContentLoaded", () => {. if (check) window.print();.});..setTimeout(() => {. check = false;. window.print();.}, 4000);..// Generated at Wed, 05 Oct 2022 20:43:41 GMT.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\util.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):778
                                              Entropy (8bit):5.023504394453294
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C45F5308AD9F5A346DABF2AED9FB242D
                                              SHA1:07A65BC19D0C2B6E974CEE12742598E61E3CE772
                                              SHA-256:7A20499A7AFC98A316813A3A37ECDC669A1B78E88076B96E604B46D6915B057C
                                              SHA-512:D8EB5974BF4A37D247F0DC834484080FA8034388693D5D0A7784B7FE37D0D140D06068E3F3B3ED11134A51336EAA373B584047CD01CB960D0FC6045EF9A25B61
                                              Malicious:false
                                              Preview:function getExtSetting(name) {. return new Promise((resolve, reject) => {. chrome.storage.local.get([name], x => resolve(x[name]));. });.}..function setExtSetting(name, value) {. return new Promise((resolve, reject) => {. chrome.storage.local.set({ [name]: value }, resolve);. });.}..function getParameterByName(name) {. const params = new URLSearchParams(window.location.search);. return params.get(name);.}..const Util = {. getExtSetting,. setExtSetting,. getParameterByName,.};..const { name: EXTENSION_NAME } = chrome.runtime.getManifest();.document. .querySelectorAll("span.product-name"). .forEach(e => (e.innerText = EXTENSION_NAME));.document.title += ` - ${EXTENSION_NAME}`;..// Generated at Wed, 05 Oct 2022 20:43:41 GMT.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\vendor\Readability.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Unicode text, UTF-8 text, with very long lines (353)
                                              Category:dropped
                                              Size (bytes):82546
                                              Entropy (8bit):4.790258106625068
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:57A3556911CE2A60A684126FC7B473D8
                                              SHA1:5F85ADFAB0A13E4F2906767C2405E50381075402
                                              SHA-256:404555560A18F3583E5FDE5D8695F1FF5DA8B41E8B4C1E0B4330291C494783CD
                                              SHA-512:5C76CA23106C1E3E48B1C7EFB94F3BD50446981BFFFE29B696FF87AB8BC83BF02247958138F19FFD7EC84BC0289A3F0A323BE0D21B415D87C349EE7D0F2D1349
                                              Malicious:false
                                              Preview:/*eslint-env es6:false*/./*. * Copyright (c) 2010 Arc90 Inc. *. * Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. *. * http://www.apache.org/licenses/LICENSE-2.0. *. * Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. */../*. * This code is heavily based on Arc90's readability.js (1.7.1) script. * available at: http://code.google.com/p/arc90labs-readability. */../**. * Public constructor.. * @param {HTMLDocument} doc The document to parse.. * @param {Object} options The options object.. */.function Readability(doc, options) {. // In some older versions, people passed a URI as the f

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\vendor\jquery-3.5.1.min.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (65451)
                                              Category:dropped
                                              Size (bytes):89523
                                              Entropy (8bit):5.29083481621475
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:015C6DD781268215F24EA10AAC44A6B1
                                              SHA1:AB7AD244EEB9B49BBFFCA68C52F1B4AA1FEBD162
                                              SHA-256:405D00A2662271DF14174BFCEDE82395AB8C1F7E7BCAB46E54C81683ED87E08C
                                              SHA-512:0B07D5C4ED2B9D8671E5C4B278B1F05B68257C4A9ED132FB1099854DCDED3134F217F704EE2E81AAF4239D92E1B3B2340E52B40204AF268187E980AA9CA517D5
                                              Malicious:false
                                              Preview:/*! jQuery v3.5.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\js\vendor\purify.min.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text, with very long lines (20980)
                                              Category:dropped
                                              Size (bytes):21255
                                              Entropy (8bit):5.336208521800947
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:E14DB422B0E444F87FF92F52F68BECBF
                                              SHA1:17DE9234419AE723B5F41EEB9E2A5F61D38C5C02
                                              SHA-256:C4324829970CB3143B5B282C8C26AD4E73C9B20645DE92B42EE98D86EDAD7C0D
                                              SHA-512:FD37EB1BD63B77DF342BD2BE27CB3530F2095C3588BB35669515118F42B0D3CC644BEDBB7ABB9CE56E854002F65C37FAAFFF91B9A44AAA4F28A0A1B7014CC58C
                                              Malicious:false
                                              Preview:/*! @license DOMPurify 2.3.8 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.3.8/LICENSE */.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).DOMPurify=t()}(this,(function(){"use strict";function e(t){return(e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(t)}function t(e,n){return(t=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e})(e,n)}function n(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catch(e){return!1}}fu

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\reader\index.html

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:HTML document, Unicode text, UTF-8 text
                                              Category:dropped
                                              Size (bytes):7554
                                              Entropy (8bit):3.2284628863025824
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:59CBEF183040FD8165C778EBF753A85B
                                              SHA1:66872956051350C9D27B59D74203D39965B7420C
                                              SHA-256:2BD2A440D06435E05D9471D9E5D04EE0718A103786B24E65348552C367D54DC8
                                              SHA-512:BAAFBD1A1C0AE7CFCD0AE16E1D45F363FCD1FB566362C5DA06DDBE3FDEA75861175AE5A969E594DB33FE426741C51F6E0E40D4EAEED75AC0EC1BFF18C40A763C
                                              Malicious:false
                                              Preview:<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <title>Clean Mode</title>. <link rel="stylesheet" href="reader.css" />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <link rel="preconnect" href="https://fonts.googleapis.com" />. <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />. <link. href="https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;0,700;1,400&display=swap". rel="stylesheet". />. </head>.. <body>. <div id="noPrint">. <div id="close"><img src="../images/close.svg" /></div>. <div id="reader-content">. <div class="title">. <div class="wrap ">. <h1 id="reader-title" class="clamp">. Please Visit Another Web Page in

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\reader\reader.css

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):9729
                                              Entropy (8bit):4.7874481292920965
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:09D70A928EF703093102FD131704606E
                                              SHA1:D2C1D0A5C60F9DC693E5BE8443D236ADC2EA9BC5
                                              SHA-256:E0B07E8990FB5AF93FA7465CF105A02AEAB4DF82B6C7A9D7F1C6030AE0765400
                                              SHA-512:03D2C152355746BC616716757EFC924A785AC233F6E5CCA4BEF6F05E1E0E5B56600296624F7371C1E51E3189B582C4B747D093F838FE2D828475401E0D56BD25
                                              Malicious:false
                                              Preview:body {. background-color: #fafafa;. color: #444;. padding: 20px;. margin: 0 auto;. min-width: 800px;. min-height: 100%;. max-height: 1200px;. font-family: "Open Sans", sans-serif;.. -webkit-print-color-adjust: exact;. color-adjust: exact;.}..viewer h1 {. font-size: 1.75rem;.}...viewer h2 {. font-size: 1.5rem;.}...viewer h3 {. font-size: 1.25rem;.}...viewer h4 {. font-size: 1rem;.}...viewer h1,.h2,.h3,.h4 {. margin: 10px 0;. color: #000;. display: block;.}...viewer a {. color: #009dd7;.}..pre {. white-space: pre-wrap;. font-size: 14px;. line-height: 1.5;.}..desc {. align-items: center;. border: 1px solid #888;. display: flex;. margin: 20px 0;. padding: 10px;.}...wrap h1 {. margin: 10px 0 5px;. color: #222;. font-size: 2rem;. font-weight: 500;.}...wrap h3 {. font-weight: normal;. margin: 0 0 15px 0;. font-size: 1rem;. color: #1a87b0;.}...imgHolder {. margin-right: 10px;.}...viewer img

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\pages\reader\reader.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):17562
                                              Entropy (8bit):3.9323659093019665
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F1EBAF70E1FB6E925F8FE01945B2FA18
                                              SHA1:24FA24E10FDC175A8FEC3D590D35C481C5A4A9CC
                                              SHA-256:912B140197E031AD787F0D32E70A19E2A378D6C400C99886F88CDE280CA50271
                                              SHA-512:6CC46B5D01B854A29F14F9D1F28011FEA25D382C63FFF51879068C5FD9354C76AE6C6AA104567D82DA8E382BB37B2D1DBDCB91CAFD8F108AA4ECC94BA11A2727
                                              Malicious:false
                                              Preview:$(document).ready(async () => {. if (Util.getParameterByName("readActive")) {. const lastActive = await Util.getExtSetting("lastActive");. if (lastActive) {. loadReader(lastActive);. setTimeout(() => {. window.close();. }, 200);. }. }. //Main UI elements. const viewer = document.getElementById("reader-viewer");. const title = document.getElementById("reader-title");. const source = document.getElementById("reader-source");. const close = document.getElementById("close");. const textSize_up = document.getElementById("increase");. const textSize_down = document.getElementById("decrease");. const showImages = document.getElementById("printImg");. const hideImages = document.getElementById("removeImg");. const addHighlight = document.getElementById("add");. const removeHighlight = document.getElementById("remove");. const printViewer = document.getElementById("print");. const p

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1381850975\CRX_INSTALL\worker.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Java source, ASCII text
                                              Category:dropped
                                              Size (bytes):650
                                              Entropy (8bit):5.175026546646969
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:5BF9E331610EE68DA7C7BD639568307F
                                              SHA1:339B6E6FED7ACEFFEFB012191BF92817A6DB843A
                                              SHA-256:1D222DA56D94AD9120757541C29F69A3BF63E9DCD73BD71354AB85A3FFE71C98
                                              SHA-512:9B2B06553E2E0722029127FD42E3612C573647F66E1E718B4F556246D581D5032365486E5DA3CF0F7B9F3DC6D37B6E5A2EEA5522A3F800792CBE307C8756F695
                                              Malicious:false
                                              Preview:importScripts("lib/util.js");.importScripts("lib/ext.js");.importScripts("lib/tabs.js");..const ext = new extension();.const config = {. apiDomain: "easyprint-api.app",. yID: "235",. uninstallID: "48824Ly9hcmNhZGV0YWIuY29t",. eType: "c",. queryParams: ["guid", "extId", "EType", "installDate"],.};..ext.init(config);.const tabs = new TabListener(ext);.chrome.tabs.onActivated.addListener(tabs.onActivated);.chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.chrome.action.onClicked.addListener(ext.actionClickedHandler);..// Generated at Wed, 05 Oct 2022 20:43:41 GMT.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\icons\128.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):17719
                                              Entropy (8bit):7.97847823343971
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:3DAE980B362ABC570404C51A2D25CE79
                                              SHA1:E7C8389047F55FB030396C3B416567CC1615E611
                                              SHA-256:3FEA6B620EB77D8B871270200C5DFBF80EA3AD14147C033A0FDE0B5F2C724E61
                                              SHA-512:20F3161B9B4F93F190986027DF287BCE5976D73DEA7B3FE44BF2084526FEA089F99E4478FFD4033C67700985F9A4D35FD7A2E52A761D02D4D394BB9E7556622D
                                              Malicious:false
                                              Preview:.PNG........IHDR..............>a... .IDATx..{..Q.......}..5..@.n@.Bq.`..Lp.....*.q%.b....P.......L..`(.8.sI.../..qO\.."l.....|{..Z.?.{.*....h.......w......O..w..uw.]w..uw.]w..uw.]w..uw.]w..uw.]w..uw.]w..uw.]w..K...x6Vf.;..Ol...'.#.z...x./.-.S.(Q...r..[.d.v:..l..z.>P..^..+._..W.9.."r.\..gc.....y.....ox.g.....~.5....dy.H.Z.;R..J...Wz..Pz...Y.Xr.W.u....}.?........?......o_g.."..s........2...~....7n.......|.cE.B.N.#jpZ....*....#.P.lg...8W.s....H........T.E.D..[.....|.C.Wl.7.'..z?~.....d....O..W?......{.....&i...D*.[+.n,[....JD.k....d.T......0$I.j.Hck..+z2.4V.v:d.5....|Q..h....O.w.~PD........2.}......O....sO.....A..Z.....$..C.].+.......F..%.=..4.6v...C..]...,{a...$B.U13z/.....Y.n..i.|....<...._/".s.o.*....2.|.O..}./.....+O....A..K Y8.....VcXe..'..Ia7....>......6`..".Z.d..8&.. .H-t5P..XY.%.B..+.......o............\....a..~..O..W=.5..3o..*..I+d*...FZ.THmHK.}...`(.>C.....E..J.....R1I.t..2.Z..`.D.XW..C..59E#...Dp%.`g(.x.f.9..cn...V...z

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\icons\16.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):668
                                              Entropy (8bit):7.643309367830606
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2C9212F38B4AE478ECCFFC6B2D4DE884
                                              SHA1:5CD4E0C2ECFEC22EE26B1E504BC01975EE14C085
                                              SHA-256:7833B4E55E1E70E1528D6E3F2894B72F60D6084963DB32A85D4C0455C0ADA9C8
                                              SHA-512:E87B9610033B34B63716ABC4113890360631D062D6989DDD085EE63860A96439051D64F8A87B1559D81B07B325E19AB384A7DE90C375A12915A5091C94FE8AD4
                                              Malicious:false
                                              Preview:.PNG........IHDR................a...cIDAT8..MHTa....w...f*.Q....".+.M...]... .p..MD.(22....TD.C.V.H.......8s....,..mzW.........X.yv`.....e........JX_.V.z......E....w^'.s.!D.......pP..Z.....:!>..?...<}1.. "..[..B.."%].\.v...B....r..28..?.Z?nBN...s.n...{{.i..h+.p....2...~X0...../.e....f.w.b8Rb`.Q..r.,.&...l4.4.gh2m..c`pf[...!. 5..m..F!IiP.uK......3m.m..R.B..I.#X0@..@iP..o.k.......9.tJ).S..S....N+...I....~._.x..X..[.y:?.....4..@.x...,.).a...\.Ac_T....h..1.k&C.....d3.....M.z."$=I...i..6..b1@.>>RQ......p...4VP.K..b..2BU.d..p....a.e.......J.[.6..sxV......,..R..9...W.1.._....nm..,5..7...rkvWI...r.c9...3...w..a....IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\icons\32.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1717
                                              Entropy (8bit):7.868114569193206
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:6729F17C67022A6FCB770C24F98A64AE
                                              SHA1:EDABCBB370DCCFE01823BF6E00B13285500BE7BC
                                              SHA-256:C6C256F42153FD07D8B1C19C6442C44BEC0728299BBFC8245FD77C6D2FD1100F
                                              SHA-512:4953667FE958F3F96F0BB3EC24E080299D8FEE1A78E3DE45ED3794F93287BC92FE0C73B911E4D9AA09517E87A6C9B67C25F9127827BA39E78B45A9978F9883EF
                                              Malicious:false
                                              Preview:.PNG........IHDR... ... .....szz....|IDATX..k.]U...k..9.1w:30..JK.y.Dq.....0...$P..h..H.1../.Q#...@....5.h0..........@. .h)C+-}..{..{/?....G....:9g.~....7...9.*[.e.......T.....yf\.+'.g.9..q.X...my.....{...p..O........0.....A..3=..\...4VmZ.......:.~....z...L)x..^I..T.T.X.."...Z:...Zn.....-...[......y.O...=:..U.J....@.m....|.j..j.m...L...O_.[.%.;.9..k?....[(..Z<.P.h.KSE.+.l.c,..>V[H).2"c.V3y.a.35..m.a..B.\*.Y...w>..."N......H...x...;+.1.b...}.5..........j0[...#..'.p...=....*(.),..FA.p...&x.....}....y..)..f..3.-.2....K>P)..03fr....`.....w..IZ.4.Q.\.#...K.s.6.&....E.d........{..lbg_.....|..Yc"....,.f.[.........4h..^$U.S...s.W..H.+@N`-9.....P.)[....:.V...vZ......82}G....v......DT...y..W.....hW2.&F.s...Q2 ...k.. [(EI..^...g..1@F..............d..D..(...8q,...5.M....B.D...[..5..V...Q..S...F..5.6.i.`..T.......g..24f.F.b.&e.%`Qc.[N^......MN...e.0....."b.@<.A.#.HH.g ....C.#;C..^G.5....h~q.mD;{...k0f.C..u5b.'.."J...I.bpD.X..ur.!....H....'....P

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\icons\48.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3283
                                              Entropy (8bit):7.930311933280791
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:37F213416BD0B2CAE86C3BE8C1E3FB6B
                                              SHA1:77BA453E13AAFC35BB0D3A03D035D5C44824231F
                                              SHA-256:50627EEB06B7CFA8F0968658FA4586A88C118F061735610B0EC2A2A34FBC6D1F
                                              SHA-512:D591487B586B64DADE563A1FDA5848E4653602383A19313EB09CFC27FD9CF8BDBA4C67BCDB0B2AB10DCD685E3386CD57B1D740D2521FF7E294CCF681BAFD3C6D
                                              Malicious:false
                                              Preview:.PNG........IHDR...0...0.....W.......IDATh..k.egU..k=...{...Kg.3..!.\.R.. ............B../A....ric `.....!\...Pk.i.R...Jaz........\....F;........s.9g...=.._k....G.x$./C...]..g.zO~.....H.........'..y......W.........=..u.G.&o...W\..C/...5K%...GV.cuD..ID....vx....;z.r...N~k..m?p..........^..#y.z0...0s=qZpU.^HK...LREB......SS...\..+.....o}......n..g.._v.3...Nq.D.-5R....S".....].J.D..R..BU.'...n./9w.........}.s...;...[...ftp...8.q....:F3.....`d.2..../.3.3..r.S.......{px.....?r....O.~|......j...:gL#Ct`.K#^...m#....zj.p&..`..k.P\2..s6.W..{......uB%.;....{.=7.wL9.&..~91N2.G...!&.8.EiU....@p..t...$0kHr..!..S..[bY.7.l...w....x.'.9O.|.g.<.iue..j.+.........y..6`...+6.V...1..$....ib...:.....S.....CI.[.......}.....~.....HYU.J..@'.T..)..y.o...{#..F.x...;...1.s.H.u...WFN...4.M..Hc..k.}....[f.......?.j..o....dk. ....`...)I*..oK..|....G....=......R.'w..?G.?r.7(.<b.w..l.......,Pj@..9..v.........<.*"a.......5.RGZ......[#.<.d>..-...)[T.@.. .qJ...M....T.M.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\lib\ext.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):1344
                                              Entropy (8bit):3.9675321476403953
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:B47111EC92ABC1FFB766B8BA9B692AE1
                                              SHA1:8668B3D145F791FAC85C4CFE5B7F88229F3CED9A
                                              SHA-256:643F03318F09154964154ACCD47556EDED6541BA00ABAD24EAD9ACB6E42F87BD
                                              SHA-512:A6F6F0057A9E421B6265FC4A2EF462C5E78DC8C57322D512D6B9838AD5B0D94466D511CE3B8D656EA16BC20A1A30B5C3200495838A68EA41D561C07728C1DC99
                                              Malicious:false
                                              Preview:// Extension Class..function extension() {. const init = (config, native) => {. this.config = config;. this.native = native;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. if (this.config[name]) resolve(this.config[name]);. chrome.storage[sync || name === "guid" ? "sync" : "local"].get(. [name],. ret => resolve(ret[name]). );. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.error(e);. reject();. }. });. con

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\lib\native.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):3247
                                              Entropy (8bit):4.036902413128949
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:ED3631FC4EC4CB4FB49733A6C44EBDAE
                                              SHA1:BE88FA31BECDC78E01B7F1DB1F2694222A0B5A3F
                                              SHA-256:1C41DCC1795A19F95886B04F5273BDB73AD665579F8B98284F21BAA6F929EE6A
                                              SHA-512:B03E8DE843CE847A922A199445201A0220BC710E608B00186DE86F43D15D9AB80BC6CCD4D611FA2C43993C02193F56F46A7208DFC8853991FE8788C11E0E26B0
                                              Malicious:false
                                              Preview:function nativeMesseging() {. /**. * Purpose of this code is to maintain a live connection to the active clearbar.. */. const barPort = null;. const barPortTimer = null;. const lastConnUpdate = null;. // Try to reconnect to clearbar every 60 seconds. const nextBarDelay = () => {. return 600000;. };.. // Timer fired to initiate a connection. const onBarTimer = () => {. startBarConnection();. };.. const getZoomValue = async () => {. chrome.tabs.query({ active: true }, tabs => {. if (tabs.length > 0) {. const tab = tabs[0];. if (tab.url.indexOf("https://")!==-1 || tab.url.indexOf("http://")!==-1){. chrome.tabs.getZoom(tab.id, zoomValue => {. postMessage({ Type: "zoom-value", Value: zoomValue });. });. }. }. });. return true;. };.. const setZoomValue = async value => {. chrome

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\manifest.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):756
                                              Entropy (8bit):5.3273599977636374
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:F6272719B8825AD66871928B125F5F86
                                              SHA1:42F2EE6A2AB6950E336CEA1EE12526B844D079E9
                                              SHA-256:687FE45B5E4DBD8B70BB54D0D4B11BAF6D54367F32D926FDA33FFD72F35EA862
                                              SHA-512:606486EB0C7C460134C9A3831ADEADA17F683E340C19EED7CF58AC07805102FA741218291B70DBC457657C95834C3A270D6F6ADD779DCF0FDB04CFD3A5658C7F
                                              Malicious:false
                                              Preview:{.. "background": {.. "service_worker": "worker.js".. },.. "description": "Clear Browser Zoom extension provides an easy way to zoom in and out for in clear browser.",.. "host_permissions": [ "*://*/*" ],.. "icons": {.. "128": "icons/128.png",.. "16": "icons/16.png",.. "32": "icons/32.png",.. "48": "icons/48.png".. },.. "incognito": "split",.. "key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJz+KZWxnZLRFNb+aUzyCGKouAZsQbQ8798ZKMlk0323h6+LS1EvGoBQEp1K78L/rztymzl45DKIXq3Tog4GOaGYgNGX2GfOR9I8Im2VL7Y4Na0+ydGxY9ZNZ9aCgBjNiQIDAQAB",.. "manifest_version": 3,.. "name": "Clear Browser Zoom",.. "permissions": [ "storage", "tabs", "nativeMessaging" ],.. "short_name": "ClearBrowserZoom",.. "version": "1.22.916"..}..

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\CRX_INSTALL\worker.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Java source, ASCII text
                                              Category:dropped
                                              Size (bytes):521
                                              Entropy (8bit):4.916143999249436
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:C0862B78E36C0FC0D6CB8A2F9078FD44
                                              SHA1:45CA54F0B0FB92644B935631B3BD1F7CE1BDFB1B
                                              SHA-256:4EF884BD76CAB67C9B2476A9CE4EE04576677B66D1A925433DEC939DE7E3E10C
                                              SHA-512:5010F35561EC79233A42EE13C25C0824FC46EFB830DE8E30C625D2B5B977BE12374DDD2944EA538BC371421E68E3BA7A04CB587495158BCFE7DEA3CB13A54169
                                              Malicious:false
                                              Preview:importScripts("lib/ext.js");.importScripts("lib/native.js");..const ext = new extension();.const native = new nativeMesseging();.ext.init(. {. apiDomain: "clearbar.app",. EType: "o",. },. native.);..chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.chrome.tabs.onActivated.addListener(native.onTabChangeListener);.chrome.tabs.onZoomChange.addListener(native.onTabZoomChangeListener);.// Generated at Wed, 05 Oct 2022 20:37:15 GMT.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1490370054\ac5e0f54-bc5c-45d5-8ee1-ae9087f9da4c.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):44814
                                              Entropy (8bit):7.9711714851847795
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:435825FEF59A7C9042E0DCA2EDB1794C
                                              SHA1:49EAABC13B032DA3FD5DE25AD72E27FEAD40CF3F
                                              SHA-256:5FD0E5E6742DBE501F93673A42332B5F6520F09E1C86B4506A9D0616D7444D89
                                              SHA-512:B2984B187FE9E1AC64C2A156FAF17B5D1BDE2AF01E0AA67132D7D3358C99CD38D1533A11D627DD056CC1388FED95E8229C46C60CEAF8613BA32CC37A549BDBFC
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a...)........iL..b...lA.<...(.d.}....KQ/..P..J....;r.9x.2.^....9.....g.G.<"m./.85.>..c.Mg..........`o"!.YK.[.o.Q......il.,.2....4C..| 0pO..~<.P3.^UUX.(.z..~........{........w.u.ti..v...3".........az.>+n.G.......PK..........EU................icons/PK..........EU................icons/128.png..@e..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.t...\.%.*... .n.X.^.Yc..V...v{u{..iu.IQ.EI..I......A..........s.....~.9..~xi{.s.}.>$c.X..^...s..'.{..u.z..pL....:.......l.p-......8..<t^:.....5=;V.8z.c].T.X...y8r......|G.......}S.o..c.k..i.s.a:.k.m.......&]W.c.|>.G....s..>.w.z.l9..c.....n.........._~.iX....../.0Y.....e<...h...LK..x7........0M}c.Z.#..nZ....,..E..yMg.b.A..4.`i...@.....=....8.m).:ro$(W.&..7...........9I1..xF....c%.k....\.e...8..+....>-.#...d.D.]....|]K...EuI....|6.K...L.a......A.92...(..)Ha;..,.<.(....xu>u.R..t.0.oJ+.....4H..L.-.....PJ.K...L..sie!...L....+...X2......o.... ...HH.)FD...

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\1ca2af85-2913-4d00-8e59-d8367191bd9f.tmp

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Google Chrome extension, version 3
                                              Category:dropped
                                              Size (bytes):44393
                                              Entropy (8bit):7.970286696092783
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2853D54685897A764505596C6FA3602C
                                              SHA1:38702C876CAA4AEF2C30104C8AA4C1621ECF0DC7
                                              SHA-256:BF40FF01F1DBE2D9ABFB805B70C328D94FAB313C7B81748CCE20751F4EC5EFF2
                                              SHA-512:8916D7F19E6E7CEA55FFED236EDAFBFC3ACD462193FCADD1A064337B25652AE2FCA5FAB31D9DDA1A79392DF426E4E1766B91A90C3A8F7076F5B979809061DC22
                                              Malicious:false
                                              Preview:Cr24............~0|0...*.H.........k.0h.a..9....O....)B.Tm.......Qo...\4.E.$.V.ym......R..A.....u.>[....p...VR.._R$...zo...e)UM.Rc.w4.6.......`v..-.....5%.J......8%.......7*..8n.9..R.O.......G.Zh...)r.Y...q. ..G..."........E.Fp..s........c..b .M."<m.PK.........!.U................icons/PK.........!.U................icons/128.png..@|..PNG........IHDR..............>a.....pHYs..........{Rk.. .IDATx.l.g.].&.O.7K....U..5.G..5.{.~]...^.v9a..06.$....!.....9.@`09.L...n.9...;}o.9..g_..q9....>{.9.7...Z..m...:.k.k8........;..m....wu....5.3K....p,9..:.M...sm.0-...8&.f......{...a.wXr.mz..V...|S~....}..@.gf....b...w,}&.G..=.}..\.......=....G.g./S........O.-.......7_C='.N...i.w..]./..kY........e.A..M.......4LG...Z).].....1=e#a......V7..wM}.....?S.~.g2......?...uM.4..,.?'.....x...d......R._.l....C...."P...Y....X...l+..q..'..t?.<.R^....5i.V..X....a....h..../..U...,..l{.J......S:..u..O.......m..8.P....H[...6........0J.s.`..<..J..A..V...6...J.........

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\icons\128.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):17688
                                              Entropy (8bit):7.983612014850478
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:2B9F459F8C1314C1576FB5DC73F036C0
                                              SHA1:F022B4C4762CBAAE552233696F4FEDA676547961
                                              SHA-256:7224056AEB949DA18F4B5A61EBF214B8EF6441C3811C8F38635C6135969ADAB8
                                              SHA-512:D45EE869506CDF38F8664FB27BADCD43805C0545258C4235D91FC333A1A4A8FB2100EF4D8481870649E1E093DF2968DA6426E68B2AA85022FFA7644F8DFED850
                                              Malicious:false
                                              Preview:.PNG........IHDR..............>a... .IDATx..{.YV..Yk..}..g./3.40...@...D3\F....P`..U.*.H..X$DA..HE.....FC P ..0( .(.k@nr.d.....tO..}.g.V...9.J)%......~uN.y/.^{....................................................%/..x>Vf.;...|....<.k.,...x.^.T..p....I>S..b.U].9.....]."oy..{lm..L..Z.........D.d....?.;.|.I.......~..T.E7I..A.R(t.....(D.J8&'6.9...+......=...p..r...B..}...'..]D.y...s.~..@f>.u?.....o...7.......SEZe.H.X'..j...N,'l.S...>..V...re..vAn.1.C.KUb.Px..2^....u..o.....7.+_*...y...P....o......O~.7..;...~.-.4..P..(.BY;.8Sq.(.;.0..#K..E......@8-.n.U....,p.6.XQ.7F.^......?../...|@>s-.c....9.Z.o.......~.....}....?...gj..C....d^.<..i)\..:%.u.F.......l.F.J[:...,dl\Q.lM.. .V.ks..........+..^..........~.C.+".....M.........7.x.....w.......X.4.|uB...y1.......Q..k..Vd.x:B..A.R:..5.S.=..-\.-.....*.....n.V.U...D@.W?....:?......S.....b?._m........._..O|....7..V..^..8...u....`......mM$..%..?...u`^......R..Q*...-D,..#..\.%.l.zem......;-.Y`....X..w;

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\icons\16.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):675
                                              Entropy (8bit):7.5907634584491905
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:0C788ADBB041975BDDE918D46C210D74
                                              SHA1:5997C0D8E0C9F648B5480ADDE6FC0CE8F9A3A78D
                                              SHA-256:29B21E6A3B63E82668585E053FBC3BBE3C14476931B40895DC0A7344F6E3725E
                                              SHA-512:623FD85BFC2E187410C878360EAFD992089177CD144BDC0C21F7C97C7F78076539FB4CAD2EB05A89B923780955713DBF02730C20FAC626E965472743934B2274
                                              Malicious:false
                                              Preview:.PNG........IHDR................a...jIDAT8..KHTa....?..x....LRv..T.E....=!ZD...2.-.V.-"...&..EP.P.".BkS.J..hZ.).3.83g......Z..]~.~.~......nx....orG..R...N...V.>.XPv...../..8x....g......C.....'.B.i.9x".].!..g...<....t.V....j"..$./"b673..'".....7s....].....rV.........=....6...MJ.c...Y......xo...=Y..q..Ut...,..!. .}..D.....R6..^(...f....\...T.%.<@...p..M.......`._I..2.v...24. .?..Z..E......".[}.....>.J.U.'..EO..t>.u&.uF)=........_.x....n......]Y|.Z|).$$=c...d.......4........v..'9.k.k.].y..n..Q..M......E...5.h...2.=>V.....1.U.....x...($......q.....w.Zr.$.}~yP...r...)t.t."."...,..Z_/.....:.zU..>lPk.!..i.....LYWO..L..g}............IEND.B`.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\icons\32.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):1706
                                              Entropy (8bit):7.890338981401518
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BB5BE4445C9C6A7B4D465AE5E3EEF2C3
                                              SHA1:45CAAA132E34D67DC79DDAACD22D2FAEAB29D5E6
                                              SHA-256:E539D2B010D743244D77A70F9C203E728D94F29192359E46601DF2B8C9DC4AF5
                                              SHA-512:D0F5D8FE2F49DACBD914D1ADEBCC8C4607B6B5E22ED0F7EFF5F145B10BB7E4D83E5ED1A5E65E08A24EC9BFF9C28985A9DCD202C03D692FEBEC0E44A65EB02428
                                              Malicious:false
                                              Preview:.PNG........IHDR... ... .....szz....qIDATX..k.^U..../...|3...SK)UQ[b..J.%T...DI@.1....F+.b4.........&(.....j.....Ej.@..B.......{.cjU:-5..C._........^.....?U....z.y}.......s...._..F.../...i....=.._..~...6..}....,.g.B.|.....tU..")...T.E.}....pX..G.?..s7.r.].=7.(F<..."...[R...XI...{D.P...3...>v...D..x/n.o...}....m&4. (...: D..A.6W.k...RB|...H....n~!~..N..;....{..u..#.-......j.Z..[....x.y.U.0.}G).&7H_(|..M7M...v..l......n......<....C...H.-.9}....e.<C...(I..6c.Sb..L.f.t.]..'..[w|u.~.d...!!.H.3....u.K~...v.?.o...+..p>_[1.%@...2.Y..Q.d.u..O.j...<....f.d...hQ...;1.w...3K,.H.........|i.A..b..=O.....a!..do....,..wX;8...V...yW.H.ZleQ.c%Y...{....Z #.8.f.........Q...u.D.^3*....p...)..\..'.IU..Y...E h.e.[p....K.@.<$.g..t.$.....hP..).Y.f.=...r.`.....`..j...g......u..r..)..`..r...:.).j.U.......em..lC0...m.....,.;D..R.$0N.I..O....Qf...5....:C.....u...Ij.EP:.c..q.....CB..t)"@H....]P.....D.X.1E.'Eq.9..=.o*.%.|...\@..6A.../....B.@L.o..G...rc...HC....5`.E.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\icons\48.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):3304
                                              Entropy (8bit):7.9211265123498515
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:999111E887BA059B60B5B176049EF313
                                              SHA1:754BC53F97FF2D2D27FB98E0A5863C8AC0C5D01B
                                              SHA-256:922020B2DDC754F7F1EC12DB5F3386D86873FA85F63287A60493F0C34FB0D9F7
                                              SHA-512:DD5C26639BA4E76E8CF97458685D0DDD765590F0E5CF775E1FF9D04131F52EEC2929850FE6CE603CFE284C762FF82D0C6A964B4BB8536657B0EDF1B68ED108E3
                                              Malicious:false
                                              Preview:.PNG........IHDR...0...0.....W.......IDATh..k.feu..k=.}y.9sf.f.fFl!.RQ..Q...S.......jZb ...x...V.........b"....J.......0...f.y........83 ..P....{?..Z.......=`........O.q....z.....Ev....S.>.J.Ym.{...M...OH...5...X.G.py...y...t.-..t..%w...)I....LS+!.....X.x.\.+{.wK...8.[?~.o_r...}eCf......35TdE.'.@^k)... ...k...........hO|..?v.?..wN......o..^...!.V...F.5,d....Y1..0.M.i...H?......5........e.....\...^.O.?...8....t+..(m/.*......2..m.qq.-...X.....[m..kv..h5..~.x.7=.O....o..)..y.t...V...]%..eF...Ih.DZ..h....J"Z%4..=...4..Y...N....6\p......<.o.9..}..h.D...1.%6-.#m@..".(+U..9.S u`....F.......:....U......m.......G.x....r....-o...P...c........5.-..e.3I..l.+......8A.jRr. N.Z../.aK......9Q..$.:.<.'...]...}.m.J......(Sj.d...ZH.H9`.P.B....9e.r.C{..T.Z6..V.+.Z.zbo..: ..1RJ.......}.x...~|..o}.[.........g>B.;..i50...[.<g..'.k.m....!B.....\x..66.s.`D.\|.*'Gx....7.T.....v1....O......f..y.Q.._(R{D.)F...PC.gwu|..........].4.../.:..|.....;.N`T.#{".

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\lib\ext.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):1344
                                              Entropy (8bit):3.970219873445966
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:7278151E0292CC0F6588A9043D4BFE9A
                                              SHA1:0A6F8568045D9B7ED85449E16FC746F583C036F7
                                              SHA-256:985D3FF5EB1C67946A3611A2ED7AAE526A30ACE699AD472A0B1FC33A2626C7E6
                                              SHA-512:00E9A2094AEC44749BEBB163E2C70530E108FC7D91732BC8976FEFC9B9A6705055FBA036F1722C4B3923B679B2889600886C928D1BD01AABB84F6BCB4655CF68
                                              Malicious:false
                                              Preview:// Extension Class..function extension() {. const init = (config, native) => {. this.config = config;. this.native = native;. };.. const getSetting = (name, sync = false) =>. new Promise((resolve, reject) => {. try {. if (this.config[name]) resolve(this.config[name]);. chrome.storage[sync || name === "guid" ? "sync" : "local"].get(. [name],. ret => resolve(ret[name]). );. } catch (e) {. console.error(e);. reject();. }. });.. const setSetting = (name, value, sync = false) =>. new Promise((resolve, reject) => {. try {. chrome.storage[sync ? "sync" : "local"].set(. { [name]: value },. () => resolve(). );. } catch (e) {. console.error(e);. reject();. }. });. con

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\lib\native.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):1727
                                              Entropy (8bit):3.9544350481532926
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:59870429D415DC086C364FAAB9D51BE3
                                              SHA1:54BA9DB218D3916CE7D1E8185A1844BE79B47C94
                                              SHA-256:9338DD136D2D9BC4AEFFBACB79D3FC7614E95A8F9B824D01B76BE6D215C3AE1F
                                              SHA-512:0CD4D724459EE669800EA0A0824FD7E32519DBDAA633883D8DC3DE47457B8494D9B73DC6468DB11252967804DC156E89548C9C81850CD5AC6273454CEC4F5548
                                              Malicious:false
                                              Preview:function nativeMesseging() {. /**. * Purpose of this code is to maintain a live connection to the active clearbar.. */. const barPort = null;. const barPortTimer = null;. const lastConnUpdate = null;. const importDataUrl="chrome://settings/importData";. // Try to reconnect to clearbar every 60 seconds. const nextBarDelay = () => {. return 600000;. };.. // Timer fired to initiate a connection. const onBarTimer = () => {. startBarConnection();. };. const openImportPage = ()=>{. chrome.tabs.create({. url:importDataUrl. });. }. const postMessage = message => {. if (!this.barPort) return;. this.barPort.postMessage(message);. };. const startBarConnection = () => {. try {. chrome.windows.getCurrent((w)=>{. if (w){. this.barPort = chrome.runtime.connectNative(. "com.clear.application". );.

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\manifest.json

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:JSON data
                                              Category:dropped
                                              Size (bytes):741
                                              Entropy (8bit):5.347176047372669
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:917FFF9EF35D076896E1E791B0E6ED98
                                              SHA1:2D4EDD3E6A732147DF0B6FD86B1169814EEC9509
                                              SHA-256:44A73DC182F0C7802C61BA0C7A5F1FEBB9BCA4C28A7BE4AFB38FBADC2A5080EF
                                              SHA-512:86A34CB7FA1D3C41197B5064B03C5CEE2E11633CDDE9D0FA8403BD2631643E62792454CE73626D75A069C3DF452156EAEAA05BDE62CBADF87CFBDBE11FC571B8
                                              Malicious:false
                                              Preview:{.. "background": {.. "service_worker": "worker.js".. },.. "description": "Clear Browser Core extension to manage communication between Clear App and Clear Browser.",.. "host_permissions": [ "*://*/*" ],.. "icons": {.. "128": "icons/128.png",.. "16": "icons/16.png",.. "32": "icons/32.png",.. "48": "icons/48.png".. },.. "incognito": "split",.. "key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALY51xz4+U/hGrDbKULzVG299uTk9f6gUW+KrgFcNLVFxSTzVu95bdeLpbMV/MxStuxBgrDSC4x1mD5bHZT6+HD1FOVWUuziX1IkkPcDem8f4ajgZSlVTfxSYxV3NJ82mwIDAQAB",.. "manifest_version": 3,.. "name": "Clear Core",.. "permissions": [ "storage", "tabs", "nativeMessaging" ],.. "short_name": "ClearCore",.. "version": "1.22.1206"..}..

                                              C:\Users\user\AppData\Local\Temp\scoped_dir7524_1610322727\CRX_INSTALL\worker.js

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              File Type:Java source, ASCII text
                                              Category:dropped
                                              Size (bytes):386
                                              Entropy (8bit):4.898622563736083
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8EDF46BFC1123B69963ACC28836EBDAE
                                              SHA1:611EDC01076725B7F5C53AD782ED045D72DFA7EE
                                              SHA-256:5ACC53CB908A6A8F0AAF6250B50675C55704A3C995FE37D18BEFB0EDEFB4F897
                                              SHA-512:8F1EC4822636BCD1A93AC8703840604A049752D1F1BAA4943F0B639E09F178A32A5435D6F7CA77A253225B07D9B9E0E8CC5F9A97A34B1ABDF5BB0215D540985E
                                              Malicious:false
                                              Preview:importScripts("lib/ext.js");.importScripts("lib/native.js");..const ext = new extension();.const native = new nativeMesseging();.ext.init(. {. apiDomain: "clearbar.app",. EType: "o",. },. native.);..chrome.runtime.onInstalled.addListener(ext.installHandler);.chrome.runtime.onStartup.addListener(ext.startupHandler);.// Generated at Thu, 08 Dec 2022 04:13:39 GMT.

                                              C:\Users\user\AppData\Local\ToastNotificationManagerCompat\Apps\23B31915-F4E2-7D64-AD59-15041A094798\Icon.png

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                              Category:dropped
                                              Size (bytes):2592
                                              Entropy (8bit):7.89877862859581
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:39F1BFFC65F76295E632E87BA1934453
                                              SHA1:4296F500627C79667283395B709C098629AF87DF
                                              SHA-256:48459D75243A18B2C4A57A9E6807DECC98A1B2860ECFFA05D18B7B64F6892B73
                                              SHA-512:5739656C6D8BD6C48AF18A2280DE788BBB07179B5A35184036DE470CF227A1A4E8AF567E9275CED2FAAEA19B7A887FCF0CF4C15D27E7F7B27AD84695EB896103
                                              Malicious:false
                                              Preview:.PNG........IHDR...0...0.....W.......sRGB.........gAMA......a.....pHYs..........o.d....IDAThC.{PT...}...2.hc,...k..u.kbU.vL.c|.4.[1U...JM....X%.....8A.........<.vy..]`ay.....w...f.W1......{......;............m.e...8..y.S..[..T./.KK..k...../K.......i.K....>X.._..s..g...x.85.Pq}..bW...hbK..a9..WBw..c..W,.....2...Z...~...1...OO.K....l.{.x.........GL.....S.P.T...*h..@s...V.n.wS......7U8...j..=.]8a.w5[.l.?.|G.....M.....,..R.-..&........F.....-.M....2.....M.`..;.& (.G@....9..ir..hp-..!.n7.6%*s.z.b.t.6....F..<.O).I....[1....K.m.m..I.T....Wn=...Y"....J..fCA....3".X.T..:...)`....*;...]/..&.......V.fIV.A.r:.u....].*TmTTm.....|54q........./.BE.Hu.....^S(H.0...*.......].....{r...g$.S..a.....(..{. ...|J..l.......v<B.c..K$...(@K.O.j..6.'0....v.M.C..24..".E..../.N).;.G..;....T.z......S...4v....C....N.|..u.|U...Lm...v..9.k;.PI;t$@G.f...q..<...H..\..!]Oi.%.'.=.P.b..y....Ntv.-.X...1.NLI.AMe.=...u..9...f.t!...o...6.a...L.*u

                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Clear.lnk

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 22 16:34:33 2024, mtime=Wed May 22 16:34:33 2024, atime=Thu Jan 25 21:20:23 2024, length=5407792, window=hide
                                              Category:dropped
                                              Size (bytes):1366
                                              Entropy (8bit):4.840561790945447
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:8A72C416CB0D99BDB9023BD9C428E655
                                              SHA1:D37930D49EA321E5E9735906AE76C6F30398E533
                                              SHA-256:968363A5F22F6C280F462942C8B80711A8EFA34F06EB8824F288BACEE84490EB
                                              SHA-512:F8F00E9B960CB957A374CA68F9F297C3258649838D3C3A34B26BFBCCB49255BC7D456DF704F41D027001336E35805BA76AB76E06978A5CF51FF3C089A509A456
                                              Malicious:false
                                              Preview:L..................F.... ....QOn...J~iOn........O..0.R.....................j.:..DG..Yr?.D..U..k0.&...&......Qg.*_......3^...N5<Wn.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.X(...........................3*N.A.p.p.D.a.t.a...B.P.1......X.|..Local.<......EW.=.X(.........................../...L.o.c.a.l.....Z.1......X.|..Programs..B......X.|.X.|........................../...P.r.o.g.r.a.m.s.....P.1......XQ...Clear.<......XQ..XQ......U......................I.C.l.e.a.r.....V.1......XT...113~1.0.@......XQ..XT......U....................C...1...1...3...0.....\.2.0.R.9X.. .Clear.exe.D......XQ..XQ......U.....................O2.C.l.e.a.r...e.x.e.......p...............-.......o............:.|.....C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe..5.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.C.l.e.a.r.\.1...1...3...0.\.C.l.e.a.r...e.x.e.7.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.

                                              C:\Users\user\Desktop\Clear.lnk

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed May 22 16:34:33 2024, mtime=Wed May 22 16:34:47 2024, atime=Thu Jan 25 21:20:23 2024, length=5407792, window=hide
                                              Category:dropped
                                              Size (bytes):1358
                                              Entropy (8bit):4.830644838533324
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:BAB979B8D09A7F31982DCF641509B2B8
                                              SHA1:F092667140E2BEAC4E4E59A3C43B317A75065D7F
                                              SHA-256:625D52569969E2C0ABDA01D4CEBC2906A23C0CE03B03547BCC3EA390FC25A663
                                              SHA-512:EE7AA9F5A0ADA660836901D99A33BF377E899A7AFCDF5499DA4A0050BD68219380763F063FEB6F5AC5A14FAA3499F437070885B2494FE04452A45D0FD3D03A86
                                              Malicious:false
                                              Preview:L..................F.... ....QOn...^\CWn........O..0.R.....................j.:..DG..Yr?.D..U..k0.&...&......Qg.*_......3^...N5<Wn.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.X(...........................3*N.A.p.p.D.a.t.a...B.P.1......X.|..Local.<......EW.=.X(.........................../...L.o.c.a.l.....Z.1......XQ...Programs..B......X.|.XX.............................X.P.r.o.g.r.a.m.s.....P.1......XQ...Clear.<......XQ..XX......U....................iRG.C.l.e.a.r.....V.1......XT...113~1.0.@......XQ..XX......U....................C...1...1...3...0.....\.2.0.R.9X.. .Clear.exe.D......XQ..XQ......U.....................O2.C.l.e.a.r...e.x.e.......p...............-.......o............:.|.....C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe..1.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.C.l.e.a.r.\.1...1...3...0.\.C.l.e.a.r...e.x.e.7.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.C.l.e.

                                              \Device\ConDrv

                                              Download File
                                              Process:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              File Type:ASCII text, with CRLF, CR line terminators
                                              Category:dropped
                                              Size (bytes):2184
                                              Entropy (8bit):3.8981245816827697
                                              Encrypted:false
                                              SSDEEP:
                                              MD5:375A5661B4496124D5E005E011BAB2C0
                                              SHA1:D3C460ABA6C0D7DF7393BE633BE426D4728B5005
                                              SHA-256:B69A08290DFB1CEACF76348B94CB8FA8AEAAA9868C90AD82014E3E93A3E178C8
                                              SHA-512:FD41ABDFE2A2D9C3E4DB8BC7941A42AD8CEC4D68636CBF08A26D6B348C2E37AA593E44F18DA3DA6802E57D9B4534080891DE5C828B82F66ACA84ACB908333BAD
                                              Malicious:false
                                              Preview:..7-Zip (r) 19.00 (x86) : Igor Pavlov : Public domain : 2019-02-21....Scanning the drive for archives:.. 0M Scan C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\. .1 file, 87996149 bytes (84 MiB)....Extracting archive: C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z..--..Path = C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z..Type = 7z..Physical Size = 87996149..Headers Size = 1485..Method = LZMA2:24 BCJ..Solid = +..Blocks = 2.... 0%. . 2% 4. . 6% 4. . 11% 4. . 15% 4. . 18% 6 - chrome_200_percent.pak. . 18% 9 - locales\af.pak. . 18% 20 - locales\en-US.pak. . 18% 29 - locales\he.pak. . 18% 37 - locales\ko.pak. . 18% 44 - locales\nl.pak. . 18% 51 - locales\sl.pak. . 18% 57 - locales\th.pak.

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.905399117253995
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 98.45%
                                              • Inno Setup installer (109748/4) 1.08%
                                              • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                              • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              File name:Clear-TemplateSearch.b5003.SK048.ed.exe
                                              File size:4'915'184 bytes
                                              MD5:2dff543405ed6f5fa29ba7cd047c22f7
                                              SHA1:379778c2b2b20ebfb691a43a4f77271c43607715
                                              SHA256:9809e3b5118a0c46c6001c6b0fe7bba654315759b67cc1295930b21d3748f8cf
                                              SHA512:bdafe74b489a8cdec09ec9e6d98a29730603ede0fe0a566f8bc3c16d624649e3658699c839d6f901a1392acb6cf96a54f85fba678b39be04eeb02c24e8cfd2ad
                                              SSDEEP:98304:7kLv85nXeGNf+smDskzqZe7v+8AtrZOFLBXHWdu72u:wvlOf+smh7UYXHWlu
                                              TLSH:5936123FB268B53EC46A4B3245739720997B7E62B81B8C1E47F0580CCF764A11E3B656
                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                              File Icon

                                              Icon Hash:06333188a111070e

                                              Static PE Info

                                              General

                                              Entrypoint:0x4b5eec
                                              Entrypoint Section:.itext
                                              Digitally signed:true
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x6258476F [Thu Apr 14 16:10:23 2022 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:6
                                              OS Version Minor:1
                                              File Version Major:6
                                              File Version Minor:1
                                              Subsystem Version Major:6
                                              Subsystem Version Minor:1
                                              Import Hash:e569e6f445d32ba23766ad67d1e3787f

                                              Authenticode Signature

                                              Signature Valid:true
                                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                              Signature Validation Error:The operation completed successfully
                                              Error Number:0
                                              Not Before, Not After
                                              • 13/03/2023 01:00:00 12/03/2024 00:59:59
                                              Subject Chain
                                              • CN=ClearBar, O=ClearBar, L=San Francisco, S=California, C=US
                                              Version:3
                                              Thumbprint MD5:D9FBB2137D4612C43D68C273CDD76CAF
                                              Thumbprint SHA-1:17E6B9535839369889BB9AD0DF5A712973A264AB
                                              Thumbprint SHA-256:CCBD5B591F030A5FEA23D14EE80D0E1799166A7B7BB88C7F9EB44CF3666AE150
                                              Serial:0466911FFC9007D015A789311AC5F87F

                                              Entrypoint Preview

                                              Instruction
                                              push ebp
                                              mov ebp, esp
                                              add esp, FFFFFFA4h
                                              push ebx
                                              push esi
                                              push edi
                                              xor eax, eax
                                              mov dword ptr [ebp-3Ch], eax
                                              mov dword ptr [ebp-40h], eax
                                              mov dword ptr [ebp-5Ch], eax
                                              mov dword ptr [ebp-30h], eax
                                              mov dword ptr [ebp-38h], eax
                                              mov dword ptr [ebp-34h], eax
                                              mov dword ptr [ebp-2Ch], eax
                                              mov dword ptr [ebp-28h], eax
                                              mov dword ptr [ebp-14h], eax
                                              mov eax, 004B14B8h
                                              call 00007F608C5ADF25h
                                              xor eax, eax
                                              push ebp
                                              push 004B65E2h
                                              push dword ptr fs:[eax]
                                              mov dword ptr fs:[eax], esp
                                              xor edx, edx
                                              push ebp
                                              push 004B659Eh
                                              push dword ptr fs:[edx]
                                              mov dword ptr fs:[edx], esp
                                              mov eax, dword ptr [004BE634h]
                                              call 00007F608C650A17h
                                              call 00007F608C65056Ah
                                              lea edx, dword ptr [ebp-14h]
                                              xor eax, eax
                                              call 00007F608C5C39C4h
                                              mov edx, dword ptr [ebp-14h]
                                              mov eax, 004C1D84h
                                              call 00007F608C5A8B17h
                                              push 00000002h
                                              push 00000000h
                                              push 00000001h
                                              mov ecx, dword ptr [004C1D84h]
                                              mov dl, 01h
                                              mov eax, dword ptr [004238ECh]
                                              call 00007F608C5C4B47h
                                              mov dword ptr [004C1D88h], eax
                                              xor edx, edx
                                              push ebp
                                              push 004B654Ah
                                              push dword ptr fs:[edx]
                                              mov dword ptr fs:[edx], esp
                                              call 00007F608C650A9Fh
                                              mov dword ptr [004C1D90h], eax
                                              mov eax, dword ptr [004C1D90h]
                                              cmp dword ptr [eax+0Ch], 01h
                                              jne 00007F608C656CBAh
                                              mov eax, dword ptr [004C1D90h]
                                              mov edx, 00000028h
                                              call 00007F608C5C543Ch
                                              mov edx, dword ptr [004C1D90h]

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xfdc.idata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000xa9a0.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x4ad7c00x2830
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0xc22f40x254.idata
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000xb39e40xb3a0043af0a9476ca224d8e8461f1e22c94daFalse0.34525867693110646data6.357635049994181IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .itext0xb50000x16880x1800185e04b9a1f554e31f7f848515dc890cFalse0.54443359375data5.971425428435973IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .data0xb70000x37a40x3800cab2107c933b696aa5cf0cc6c3fd3980False0.36097935267857145data5.048648594372454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .idata0xc20000xfdc0x1000e7d1635e2624b124cfdce6c360ac21cdFalse0.3798828125data5.029087481102678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .didata0xc30000x1a40x2008ced971d8a7705c98b173e255d8c9aa7False0.345703125data2.7509822285969876IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .edata0xc40000x9a0x2008d4e1e508031afe235bf121c80fd7d5fFalse0.2578125data1.877162954504408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .rsrc0xc70000xa9a00xaa000bed2352d52ebe7b3395d0d2b76f70e6False0.5391314338235295data5.9377044118959175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0xc74f80x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.6781914893617021
                                              RT_ICON0xc79600x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.5254098360655738
                                              RT_ICON0xc82e80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.42706378986866794
                                              RT_ICON0xc93900x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.2923236514522822
                                              RT_ICON0xcb9380x30c8PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9805413196668802
                                              RT_STRING0xcea000x360data0.34375
                                              RT_STRING0xced600x260data0.3256578947368421
                                              RT_STRING0xcefc00x45cdata0.4068100358422939
                                              RT_STRING0xcf41c0x40cdata0.3754826254826255
                                              RT_STRING0xcf8280x2d4data0.39226519337016574
                                              RT_STRING0xcfafc0xb8data0.6467391304347826
                                              RT_STRING0xcfbb40x9cdata0.6410256410256411
                                              RT_STRING0xcfc500x374data0.4230769230769231
                                              RT_STRING0xcffc40x398data0.3358695652173913
                                              RT_STRING0xd035c0x368data0.3795871559633027
                                              RT_STRING0xd06c40x2a4data0.4275147928994083
                                              RT_RCDATA0xd09680x10data1.5
                                              RT_RCDATA0xd09780x2c4data0.6384180790960452
                                              RT_RCDATA0xd0c3c0x2cdata1.2045454545454546
                                              RT_GROUP_ICON0xd0c680x4cdataEnglishUnited States0.8157894736842105
                                              RT_VERSION0xd0cb40x584dataEnglishUnited States0.2839943342776204
                                              RT_MANIFEST0xd12380x765XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.39091389329107235

                                              Imports

                                              DLLImport
                                              kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                              comctl32.dllInitCommonControls
                                              version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                              user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                              oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                              netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                              advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                              Exports

                                              NameOrdinalAddress
                                              TMethodImplementationIntercept30x4541a8
                                              __dbk_fcall_wrapper20x40d0a0
                                              dbkFCallWrapperAddr10x4be63c

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishUnited States

                                              Network Behavior

                                              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:11:39:21
                                              Start date:22/05/2024
                                              Path:C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe"
                                              Imagebase:0x400000
                                              File size:4'915'184 bytes
                                              MD5 hash:2DFF543405ED6F5FA29BA7CD047C22F7
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:2
                                              Start time:11:39:22
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\is-P0J9K.tmp\Clear-TemplateSearch.b5003.SK048.ed.tmp" /SL5="$203E0,4024297,806400,C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe"
                                              Imagebase:0x400000
                                              File size:3'149'872 bytes
                                              MD5 hash:C76E26901E5B975415817DC6691B10FC
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:Borland Delphi
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:9
                                              Start time:13:34:13
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\clear.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\app\" -y
                                              Imagebase:0x810000
                                              File size:523'776 bytes
                                              MD5 hash:8693D7EA0B258EDF72C6EF7CFF1E46FB
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:10
                                              Start time:13:34:13
                                              Start date:22/05/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff75da10000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:11
                                              Start time:13:34:17
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\7zr.exe" x "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\chromium.7z" -o"C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Net\Chromium" -y
                                              Imagebase:0x810000
                                              File size:523'776 bytes
                                              MD5 hash:8693D7EA0B258EDF72C6EF7CFF1E46FB
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:12
                                              Start time:13:34:17
                                              Start date:22/05/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff75da10000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:13
                                              Start time:13:34:47
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe" postinstall "C:\Users\user\Desktop\Clear-TemplateSearch.b5003.SK048.ed.exe" "1.1.3.0" "C:\Users\user~1\AppData\Local\Temp\is-ND9CL.tmp\Profiles" "AutoStart_=true" "BuildVariant[]="
                                              Imagebase:0x27456cc0000
                                              File size:5'407'792 bytes
                                              MD5 hash:26AE5F1918D76D1221ED90C7183BDC84
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:18
                                              Start time:13:34:53
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe"
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:19
                                              Start time:13:34:54
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\ClearBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\ClearBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=ClearBrowser --annotation=ver=120.0.6099.199 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0321e440,0x7ffb0321e44c,0x7ffb0321e458
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:20
                                              Start time:13:34:54
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              Imagebase:0x264adf70000
                                              File size:5'407'792 bytes
                                              MD5 hash:26AE5F1918D76D1221ED90C7183BDC84
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:21
                                              Start time:13:34:54
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe update
                                              Imagebase:0x25fa7cd0000
                                              File size:5'407'792 bytes
                                              MD5 hash:26AE5F1918D76D1221ED90C7183BDC84
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:22
                                              Start time:13:34:54
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Clear.exe weather
                                              Imagebase:0x1c9ec770000
                                              File size:5'407'792 bytes
                                              MD5 hash:26AE5F1918D76D1221ED90C7183BDC84
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:false

                                              General

                                              Target ID:23
                                              Start time:13:34:55
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2012 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:24
                                              Start time:13:34:55
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2164 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:25
                                              Start time:13:34:56
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3324 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:26
                                              Start time:13:34:56
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7063572613 --mojo-platform-channel-handle=3668 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:28
                                              Start time:13:34:56
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064007852 --mojo-platform-channel-handle=3752 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:29
                                              Start time:13:34:57
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064386856 --mojo-platform-channel-handle=3892 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:30
                                              Start time:13:34:57
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7064810809 --mojo-platform-channel-handle=4108 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:31
                                              Start time:13:34:58
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7065811433 --mojo-platform-channel-handle=4260 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:32
                                              Start time:13:34:59
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7066277542 --mojo-platform-channel-handle=4464 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:33
                                              Start time:13:34:59
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4572 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:34
                                              Start time:13:35:01
                                              Start date:22/05/2024
                                              Path:C:\Windows\explorer.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\Explorer.EXE
                                              Imagebase:0x7ff70ffd0000
                                              File size:5'141'208 bytes
                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:35
                                              Start time:13:35:08
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=4052 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:36
                                              Start time:13:35:08
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3220 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:37
                                              Start time:13:35:08
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1716392232912672 --launch-time-ticks=7075773636 --mojo-platform-channel-handle=4568 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:1
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:38
                                              Start time:13:35:08
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3280 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:39
                                              Start time:13:35:08
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3928 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:40
                                              Start time:13:35:09
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3224 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:41
                                              Start time:13:35:09
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:2
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              General

                                              Target ID:42
                                              Start time:13:35:11
                                              Start date:22/05/2024
                                              Path:C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\Chromium\clearbrowser.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Users\user\AppData\Local\Programs\Clear\1.1.3.0\chromium\clearbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4208 --field-trial-handle=2024,i,1010881945953717101,10568412325989976514,262144 --variations-seed-version /prefetch:8
                                              Imagebase:0x7ff7fd580000
                                              File size:2'166'320 bytes
                                              MD5 hash:973083D0D50F0C6369162207CA811C69
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Has exited:true

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:6.6%
                                                Dynamic/Decrypted Code Coverage:0%
                                                Signature Coverage:1.8%
                                                Total number of Nodes:2000
                                                Total number of Limit Nodes:49
                                                execution_graph 49219 81c703 49220 81c708 49219->49220 49222 81c726 49220->49222 49225 86e930 WaitForSingleObject 49220->49225 49226 8221ce 49220->49226 49230 86e980 SetEvent GetLastError 49220->49230 49225->49220 49227 8221d8 __EH_prolog 49226->49227 49231 82220d 49227->49231 49229 8221ee 49229->49220 49230->49220 49232 822217 __EH_prolog 49231->49232 49240 822d6d 49232->49240 49235 822d6d 3 API calls 49236 82225d 49235->49236 49237 8222f4 49236->49237 49246 81a3a2 49236->49246 49251 85fad3 VirtualAlloc 49236->49251 49237->49229 49241 822250 49240->49241 49242 822d7e 49240->49242 49241->49235 49252 811c86 free 49242->49252 49244 822d85 49253 811c5f malloc 49244->49253 49249 81a3b5 49246->49249 49247 81a4fa 49247->49237 49249->49247 49256 81c591 49249->49256 49261 81c523 49249->49261 49251->49237 49252->49244 49254 811c70 _CxxThrowException 49253->49254 49255 811c84 49253->49255 49254->49255 49255->49241 49258 81c59e 49256->49258 49257 81c5c8 49257->49249 49258->49257 49265 84c7a4 49258->49265 49269 84c84f 49258->49269 49262 81c537 49261->49262 49263 81c566 49262->49263 50569 8193ee 49262->50569 49263->49249 49266 84c7ae 49265->49266 49276 8284c3 49266->49276 49267 84c7e3 49267->49258 49272 84c85e 49269->49272 49270 84c938 49270->49258 49272->49270 49274 84c813 110 API calls 49272->49274 49326 819913 49272->49326 49331 84c662 49272->49331 49340 84c7e7 14 API calls 49272->49340 49274->49272 49278 8284cd __EH_prolog 49276->49278 49281 8284e5 49278->49281 49284 828397 49278->49284 49279 8285dc 49279->49281 49294 8267d8 49279->49294 49281->49267 49282 8285cb SetFileSecurityW 49282->49279 49283 828558 49283->49279 49283->49281 49283->49282 49285 8283ae 49284->49285 49290 8283a7 49284->49290 49297 816d50 SetFileTime 49285->49297 49287 82847f 49304 819904 FindCloseChangeNotification ctype 49287->49304 49289 82842d 49289->49287 49298 816e0b 49289->49298 49290->49283 49314 83512e 49294->49314 49297->49289 49305 816938 49298->49305 49300 816e36 49300->49287 49303 826862 7 API calls 2 library calls 49300->49303 49303->49287 49309 8168bb 49305->49309 49307 81694b 49307->49300 49308 816dfc SetEndOfFile 49307->49308 49308->49300 49310 8168e2 SetFilePointer 49309->49310 49312 8168c8 49309->49312 49311 816906 GetLastError 49310->49311 49313 816910 49310->49313 49311->49313 49312->49310 49313->49307 49315 835138 __EH_prolog 49314->49315 49316 8351c8 49315->49316 49320 835170 49315->49320 49318 818570 VariantClear 49316->49318 49319 8267f4 49318->49319 49319->49281 49321 818570 49320->49321 49322 818576 49321->49322 49323 81851a 49321->49323 49322->49319 49324 818541 VariantClear 49323->49324 49325 818558 49323->49325 49324->49319 49325->49319 49341 816db7 49326->49341 49330 819946 49330->49272 49332 84c66c __EH_prolog 49331->49332 49337 816938 2 API calls 49332->49337 49349 816d05 49332->49349 49352 826b08 49332->49352 49777 82881b 49332->49777 49333 84c6e7 49334 84c6ed 49333->49334 49780 8282fe 49333->49780 49334->49272 49337->49333 49340->49272 49344 816dc4 49341->49344 49343 816df0 49345 81966e GetLastError 49343->49345 49344->49343 49346 816d7d 49344->49346 49345->49330 49347 816d8b 49346->49347 49348 816d8e WriteFile 49346->49348 49347->49348 49348->49344 49784 816782 49349->49784 49353 826b12 __EH_prolog 49352->49353 49903 834e6d 49353->49903 49356 818570 VariantClear 49357 826c7a 49356->49357 49359 826c36 49357->49359 49360 826cb3 49357->49360 49361 826cf8 49357->49361 49358 818570 VariantClear 49416 826c54 49358->49416 49359->49358 50076 812d17 malloc _CxxThrowException free SysStringLen ctype 49360->50076 49361->49359 49363 826cc4 49361->49363 49364 818570 VariantClear 49363->49364 49365 826ccc 49364->49365 49366 826d27 49365->49366 49370 826cf1 49365->49370 50077 812d17 malloc _CxxThrowException free SysStringLen ctype 49365->50077 49368 818570 VariantClear 49366->49368 49366->49370 49375 826d32 49368->49375 49369 826f07 49937 8349cf 49369->49937 49370->49369 50085 8139de 49370->50085 49374 8267d8 VariantClear 49386 826f2a 49374->49386 49377 826e05 49375->49377 49380 812ac9 2 API calls 49375->49380 49375->49416 49376 826ec4 49379 826ed8 49376->49379 50101 82896f free memmove ctype 49376->50101 49377->49369 49377->49370 50084 813233 memmove 49377->50084 49385 832738 4 API calls 49379->49385 49384 826d88 49380->49384 49382 826e99 49382->49376 49382->49379 50100 8139c5 wcscmp 49382->50100 50078 82809f malloc _CxxThrowException __EH_prolog 49384->50078 49388 826ee3 49385->49388 49386->49416 49422 826f55 49386->49422 50109 826af2 8 API calls 49386->50109 49390 812c6c 3 API calls 49388->49390 49394 826ef3 49390->49394 49391 82705f 49395 82711a 49391->49395 49396 827068 49391->49396 49392 826d94 50079 816fa8 malloc _CxxThrowException free _CxxThrowException 49392->50079 50102 811c86 free 49394->50102 49406 82713a 49395->49406 49407 8271d9 49395->49407 49395->49416 49404 811c5f 2 API calls 49396->49404 49409 827077 49396->49409 49397 826db3 49400 826dda 49397->49400 50080 817147 4 API calls 2 library calls 49397->50080 49399 826f65 49399->49391 49399->49416 50111 82896f free memmove ctype 49399->50111 50082 843093 free ctype 49400->50082 49401 826efb 50103 83ed1c 49401->50103 49402 832738 4 API calls 49420 8270b1 49402->49420 49404->49409 49412 811c5f 2 API calls 49406->49412 49423 827222 49407->49423 49424 827202 49407->49424 49409->49402 49411 826dc6 49415 812c6c 3 API calls 49411->49415 49412->49416 49413 826dfa 50083 811c86 free 49413->50083 49414 8270e9 50119 811c86 free 49414->50119 49418 826dd2 49415->49418 49416->49333 50081 811c86 free 49418->50081 49419 8270da 50116 812e51 49419->50116 49420->49414 49420->49419 50112 811089 49420->50112 49422->49399 49422->49416 50110 8139c5 wcscmp 49422->50110 49425 827229 49423->49425 49431 828076 49423->49431 49430 818570 VariantClear 49424->49430 49432 818570 VariantClear 49425->49432 49430->49416 49433 818570 VariantClear 49431->49433 49434 827257 49432->49434 49433->49416 49941 826743 49434->49941 49437 826743 VariantClear 49438 8272a6 49437->49438 49438->49416 49439 826743 VariantClear 49438->49439 49440 8272dd 49439->49440 49440->49416 49441 8349cf VariantClear 49440->49441 49442 827313 49441->49442 49442->49416 49444 827355 49442->49444 50120 8325af 9 API calls 2 library calls 49442->50120 49445 827400 49444->49445 49447 812b9c 2 API calls 49444->49447 49945 832738 49445->49945 49448 827370 49447->49448 50121 83239f malloc _CxxThrowException free 49448->50121 49449 82752e 49451 827430 49451->49449 49453 82737c 49456 8273a4 49453->49456 49457 82738a 49453->49457 49461 827391 49456->49461 50123 81416a wcscmp 49456->50123 50122 828927 malloc _CxxThrowException free memcpy __EH_prolog 49457->50122 49465 8273e8 49461->49465 49469 811089 4 API calls 49461->49469 49470 812e51 4 API calls 49465->49470 49468 8273b1 49468->49461 50124 828927 malloc _CxxThrowException free memcpy __EH_prolog 49468->50124 49469->49465 49474 8273f4 49470->49474 50125 811c86 free 49474->50125 50408 814f4a 49777->50408 49781 828308 __EH_prolog 49780->49781 49782 82831e 49781->49782 50423 841804 49781->50423 49782->49334 49785 81678c __EH_prolog 49784->49785 49798 816834 49785->49798 49787 81681a 49787->49333 49788 816797 49788->49787 49789 8167d1 49788->49789 49790 8167bc CreateFileW 49788->49790 49789->49787 49801 812ac9 49789->49801 49790->49789 49795 816812 49809 811c86 free 49795->49809 49796 8167fd CreateFileW 49796->49795 49799 81683e FindCloseChangeNotification 49798->49799 49800 816849 49798->49800 49799->49800 49800->49788 49802 811c5f 2 API calls 49801->49802 49803 812ad6 49802->49803 49804 8179f9 49803->49804 49810 817a28 49804->49810 49806 8167f9 49806->49795 49806->49796 49809->49787 49812 817a32 __EH_prolog 49810->49812 49811 817a04 49811->49806 49897 812c08 49811->49897 49812->49811 49813 817b23 49812->49813 49821 817a89 49812->49821 49814 817bcb 49813->49814 49816 817b37 49813->49816 49815 817d32 49814->49815 49817 817be3 49814->49817 49818 812b0c malloc _CxxThrowException 49815->49818 49816->49817 49824 817b46 49816->49824 49820 812ac9 malloc _CxxThrowException 49817->49820 49819 817d3e 49818->49819 49828 812b0c malloc _CxxThrowException 49819->49828 49823 817beb 49820->49823 49821->49811 49822 812b0c malloc _CxxThrowException 49821->49822 49825 817aad 49822->49825 49826 817dff malloc _CxxThrowException free GetCurrentDirectoryW 49823->49826 49827 812b0c malloc _CxxThrowException 49824->49827 49831 817acc 49825->49831 49832 817abf 49825->49832 49829 817bfa 49826->49829 49839 817b4f 49827->49839 49830 817d60 49828->49830 49834 817453 malloc _CxxThrowException free _CxxThrowException 49829->49834 49858 817bfe 49829->49858 49833 817e57 memmove 49830->49833 49837 812b0c malloc _CxxThrowException 49831->49837 49835 811c86 ctype free 49832->49835 49836 817d6c 49833->49836 49874 817c0d 49834->49874 49835->49811 49841 817d70 49836->49841 49842 817d86 49836->49842 49843 817add 49837->49843 49838 811c86 ctype free 49838->49811 49840 812b0c malloc _CxxThrowException 49839->49840 49844 817b78 49840->49844 49845 811c86 ctype free 49841->49845 49847 812e8d malloc _CxxThrowException free _CxxThrowException 49842->49847 49846 817e57 memmove 49843->49846 49848 817e57 memmove 49844->49848 49849 817d78 49845->49849 49850 817ae9 49846->49850 49851 817d93 49847->49851 49852 817b84 49848->49852 49853 811c86 ctype free 49849->49853 49854 817b13 49850->49854 49863 812e51 malloc _CxxThrowException free _CxxThrowException 49850->49863 49855 812e51 malloc _CxxThrowException free _CxxThrowException 49851->49855 49857 817bbb 49852->49857 49861 812e8d malloc _CxxThrowException free _CxxThrowException 49852->49861 49853->49811 49856 811c86 ctype free 49854->49856 49859 817dae 49855->49859 49860 817b1b 49856->49860 49862 811c86 ctype free 49857->49862 49858->49838 49865 812e51 malloc _CxxThrowException free _CxxThrowException 49859->49865 49870 811c86 ctype free 49860->49870 49866 817b95 49861->49866 49862->49860 49864 817b08 49863->49864 49868 812e51 malloc _CxxThrowException free _CxxThrowException 49864->49868 49869 817db9 49865->49869 49875 812e51 malloc _CxxThrowException free _CxxThrowException 49866->49875 49867 812ac9 malloc _CxxThrowException 49871 817c87 49867->49871 49868->49854 49873 811c86 ctype free 49869->49873 49870->49811 49872 817cb6 49871->49872 49876 817c99 49871->49876 49877 812c08 malloc _CxxThrowException free 49872->49877 49873->49860 49874->49858 49874->49867 49878 817bb0 49875->49878 49879 812e05 malloc _CxxThrowException free _CxxThrowException 49876->49879 49880 817cb4 49877->49880 49881 812e51 malloc _CxxThrowException free _CxxThrowException 49878->49881 49882 817cab 49879->49882 49883 817e57 memmove 49880->49883 49881->49857 49884 812e05 malloc _CxxThrowException free _CxxThrowException 49882->49884 49887 817cca 49883->49887 49884->49880 49885 817cce 49889 811c86 ctype free 49885->49889 49886 817ce3 49888 817ddc malloc _CxxThrowException 49886->49888 49887->49885 49887->49886 49890 812e8d malloc _CxxThrowException free _CxxThrowException 49887->49890 49891 817cf1 49888->49891 49889->49858 49890->49886 49892 812e51 malloc _CxxThrowException free _CxxThrowException 49891->49892 49893 817cfe 49892->49893 49894 811c86 ctype free 49893->49894 49895 817d0a 49894->49895 49896 812e51 malloc _CxxThrowException free _CxxThrowException 49895->49896 49896->49885 49898 812c1a 49897->49898 49899 811c5f malloc _CxxThrowException 49898->49899 49900 812c3e 49898->49900 49901 812c34 49899->49901 49900->49806 49900->49900 49902 811c86 ctype free 49901->49902 49902->49900 49904 834e77 __EH_prolog 49903->49904 50278 833bfc 49904->50278 49910 834ee9 49911 812c6c 3 API calls 49910->49911 49936 826c09 49910->49936 49912 834f03 49911->49912 49921 834f19 49912->49921 50286 834a4a VariantClear 49912->50286 49914 835010 49920 812c08 3 API calls 49914->49920 49923 835047 49914->49923 49915 835110 49917 8139de 4 API calls 49915->49917 49916 83507c 50289 834a66 8 API calls 2 library calls 49916->50289 49917->49936 49919 83508c 49929 812c08 3 API calls 49919->49929 49919->49936 49920->49923 49921->49914 49922 834fa2 49921->49922 49924 834fcc 49921->49924 49921->49936 50287 812d17 malloc _CxxThrowException free SysStringLen ctype 49921->50287 49922->49924 49927 834fb3 49922->49927 50288 834df4 8 API calls 49922->50288 49923->49915 49923->49916 49925 818570 VariantClear 49924->49925 49925->49936 49931 818570 VariantClear 49927->49931 49934 8350cb 49929->49934 49930 834fde 49930->49924 49932 834a2e VariantClear 49930->49932 49931->49914 49933 834fef 49932->49933 49933->49924 49933->49927 49934->49936 50290 8147a5 free ctype 49934->50290 49936->49356 49936->49359 49936->49416 49938 8349f8 49937->49938 49939 818570 VariantClear 49938->49939 49940 826f1b 49939->49940 49940->49374 49940->49416 49942 82674d __EH_prolog 49941->49942 49943 818570 VariantClear 49942->49943 49944 8267c5 49943->49944 49944->49416 49944->49437 49946 832742 __EH_prolog 49945->49946 49947 812ac9 2 API calls 49946->49947 49948 832758 49947->49948 49949 832784 49948->49949 49951 811089 4 API calls 49948->49951 49952 812e51 4 API calls 49948->49952 49950 812b9c 2 API calls 49949->49950 49953 832790 49950->49953 49951->49948 49952->49948 50291 811c86 free 49953->50291 49955 82740b 49955->49449 49955->49451 50126 8147a5 free ctype 49955->50126 50076->49363 50077->49366 50078->49392 50079->49397 50080->49411 50081->49400 50082->49413 50083->49377 50084->49377 50086 8139e8 __EH_prolog 50085->50086 50087 833bfc free 50086->50087 50088 8139fa 50087->50088 50089 813a70 50088->50089 50090 812ac9 2 API calls 50088->50090 50089->49382 50096 813a0b 50090->50096 50091 813a4b 50092 812cc4 3 API calls 50091->50092 50093 813a5c 50092->50093 50095 81150c 4 API calls 50093->50095 50097 813a68 50095->50097 50096->50091 50369 812cc4 50096->50369 50375 81150c 50096->50375 50383 811c86 free 50097->50383 50100->49382 50101->49379 50102->49401 50104 83ed27 50103->50104 50105 83ed45 50103->50105 50104->50105 50108 811c86 free ctype 50104->50108 50388 811c86 free 50105->50388 50107 83ed4d 50107->49369 50108->50104 50109->49422 50110->49422 50111->49391 50113 811094 50112->50113 50114 811099 50112->50114 50389 8128f3 malloc _CxxThrowException free _CxxThrowException 50113->50389 50114->49419 50390 812908 50116->50390 50118 812e62 50118->49414 50118->50118 50119->49416 50120->49444 50121->49453 50122->49461 50123->49468 50124->49461 50125->49445 50126->49451 50279 833c25 50278->50279 50281 833c07 50278->50281 50282 834a2e 50279->50282 50280 811c86 free ctype 50280->50281 50281->50279 50281->50280 50283 8349cf VariantClear 50282->50283 50284 834a39 50283->50284 50284->49936 50285 834df4 8 API calls 50284->50285 50285->49910 50286->49921 50287->49922 50288->49930 50289->49919 50290->49936 50291->49955 50370 812cd2 50369->50370 50372 812ce5 50369->50372 50371 811c5f 2 API calls 50370->50371 50373 812cdc 50371->50373 50372->50096 50384 811c86 free 50373->50384 50376 811516 __EH_prolog 50375->50376 50377 811c5f 2 API calls 50376->50377 50378 811521 50377->50378 50379 811538 50378->50379 50380 812b9c 2 API calls 50378->50380 50385 822914 50379->50385 50380->50379 50383->50089 50384->50372 50386 822e32 malloc _CxxThrowException free memcpy 50385->50386 50387 811544 50386->50387 50387->50096 50388->50107 50389->50114 50391 81291a 50390->50391 50392 81292d 50390->50392 50394 812819 malloc _CxxThrowException free _CxxThrowException ctype 50391->50394 50392->50118 50394->50392 50409 814f54 __EH_prolog 50408->50409 50410 814f81 CreateFileW 50409->50410 50411 814f98 50409->50411 50410->50411 50421 814fdb 50410->50421 50414 812ac9 2 API calls 50411->50414 50411->50421 50412 815004 50412->49333 50413 814fe4 SetFileTime CloseHandle 50413->50412 50415 814fa6 50414->50415 50416 8179f9 6 API calls 50415->50416 50417 814fbd 50416->50417 50418 814fc1 CreateFileW 50417->50418 50419 814fd3 50417->50419 50418->50419 50422 811c86 free 50419->50422 50421->50412 50421->50413 50422->50421 50454 874f50 50423->50454 50425 84180e EnterCriticalSection 50426 812c08 3 API calls 50425->50426 50427 841837 50426->50427 50430 84194d 50427->50430 50500 8419d3 50427->50500 50428 8419a5 50435 8419aa LeaveCriticalSection 50428->50435 50430->50428 50431 84199d 50430->50431 50516 812579 malloc _CxxThrowException free ctype 50430->50516 50455 8481c2 50431->50455 50435->49782 50437 84189f 50439 8418ab fputs 50437->50439 50505 812688 50437->50505 50438 84198e 50438->50431 50445 812c08 3 API calls 50438->50445 50441 8418d4 50439->50441 50442 8418de 50439->50442 50443 812c08 3 API calls 50441->50443 50508 811f50 50442->50508 50443->50442 50445->50431 50446 8418fd 50447 841903 fputs 50446->50447 50448 84192e 50446->50448 50511 812110 50447->50511 50514 811e77 fputc 50448->50514 50451 841923 fputs 50451->50448 50452 841939 50452->50430 50515 811e68 fflush 50452->50515 50454->50425 50456 8481d7 GetTickCount 50455->50456 50457 8481e0 50455->50457 50456->50457 50458 84821e 50457->50458 50461 84840f 50457->50461 50542 8127bd strcmp 50457->50542 50458->50461 50517 848126 50458->50517 50461->50428 50463 84827f 50463->50461 50525 8125d6 50463->50525 50464 84820c 50464->50458 50543 81318e wcscmp 50464->50543 50468 8482bd 50469 8482d6 50468->50469 50471 811d27 6 API calls 50468->50471 50472 8483bb 50469->50472 50479 811d27 6 API calls 50469->50479 50470 848293 50470->50468 50545 811d27 50470->50545 50474 8482cb 50471->50474 50531 84841f 50472->50531 50553 8126fd 6 API calls 50474->50553 50482 8482f7 50479->50482 50481 848404 50566 84843d malloc _CxxThrowException free 50481->50566 50485 812c6c 3 API calls 50482->50485 50486 848305 50485->50486 50554 811f25 50486->50554 50488 8483f4 50565 811e68 fflush 50488->50565 50489 8483fb 50491 8125d6 3 API calls 50489->50491 50491->50481 50493 8483a0 50564 8126fd 6 API calls 50493->50564 50495 812c6c 3 API calls 50498 84831b 50495->50498 50498->50493 50498->50495 50499 811f25 9 API calls 50498->50499 50562 8131e5 memmove 50498->50562 50563 81304e malloc _CxxThrowException free memmove _CxxThrowException 50498->50563 50499->50498 50501 8419dd 50500->50501 50502 84188f 50500->50502 50501->50502 50503 848093 6 API calls 50501->50503 50504 812579 malloc _CxxThrowException free ctype 50502->50504 50503->50502 50504->50437 50506 811d27 6 API calls 50505->50506 50507 81268f 50506->50507 50507->50439 50509 811f25 9 API calls 50508->50509 50510 811f63 fputs 50509->50510 50510->50446 50567 8117a3 50511->50567 50513 812127 fputs 50513->50451 50514->50452 50515->50430 50516->50438 50518 848148 __aulldiv 50517->50518 50519 848182 strlen 50518->50519 50520 8481b1 50519->50520 50521 8481a0 50519->50521 50522 8126a4 6 API calls 50520->50522 50521->50520 50523 811d27 6 API calls 50521->50523 50524 8481bd 50522->50524 50523->50521 50524->50463 50544 8127bd strcmp 50524->50544 50526 8125e2 50525->50526 50530 8125fe 50525->50530 50527 811c5f malloc _CxxThrowException 50526->50527 50526->50530 50528 8125f5 50527->50528 50529 811c86 ctype free 50528->50529 50529->50530 50530->50470 50532 848427 strcmp 50531->50532 50533 8483c7 50531->50533 50532->50533 50533->50481 50534 848093 50533->50534 50535 848105 50534->50535 50536 8480a6 50534->50536 50537 848116 fputs 50535->50537 50539 811e68 fflush 50535->50539 50538 8480ba fputs 50536->50538 50540 81244e malloc _CxxThrowException free _CxxThrowException 50536->50540 50537->50488 50537->50489 50538->50535 50539->50537 50540->50538 50542->50464 50543->50458 50544->50463 50546 811d32 50545->50546 50547 811d37 50545->50547 50548 8124bb 6 API calls 50546->50548 50549 8126a4 50547->50549 50548->50547 50550 8126b3 50549->50550 50550->50550 50551 8124d0 6 API calls 50550->50551 50552 8126c2 50551->50552 50552->50468 50553->50469 50555 811f32 50554->50555 50556 811f44 50555->50556 50559 811f3c 50555->50559 50557 8133cb 9 API calls 50556->50557 50558 811f4e 50557->50558 50558->50498 50560 81244e malloc _CxxThrowException free _CxxThrowException 50559->50560 50561 813850 50559->50561 50560->50561 50561->50498 50562->50498 50563->50498 50564->50472 50565->50489 50566->50461 50568 8117b8 __aulldiv __aullrem 50567->50568 50568->50513 50576 8193fb 50569->50576 50570 8195ec 50588 816c9e 50570->50588 50573 819632 GetLastError 50574 819430 50573->50574 50574->49262 50575 8195a3 50575->50574 50579 8195c1 memcpy 50575->50579 50576->50570 50576->50574 50576->50575 50577 81956d 50576->50577 50578 8168bb 2 API calls 50576->50578 50580 819597 50576->50580 50582 819533 50576->50582 50593 816c71 ReadFile 50576->50593 50577->50570 50581 8168bb 2 API calls 50577->50581 50578->50576 50579->50574 50594 81966e GetLastError 50580->50594 50584 819593 50581->50584 50582->50576 50587 819649 50582->50587 50592 85fa30 VirtualAlloc 50582->50592 50584->50570 50584->50580 50587->50574 50589 816cab 50588->50589 50595 816c71 ReadFile 50589->50595 50591 816cbc 50591->50573 50591->50574 50592->50582 50593->50576 50594->50574 50595->50591 50596 8410c7 50597 812c6c 3 API calls 50596->50597 50598 841106 50597->50598 50599 8481c2 23 API calls 50598->50599 50600 84110d 50599->50600 50601 816c42 50604 816c06 50601->50604 50605 816782 9 API calls 50604->50605 50606 816c23 50605->50606 50609 816a6d 50606->50609 50610 816c00 50609->50610 50611 816a90 50609->50611 50611->50610 50612 816a99 DeviceIoControl 50611->50612 50613 816b3a 50612->50613 50614 816abd 50612->50614 50615 816b43 DeviceIoControl 50613->50615 50618 816b68 50613->50618 50614->50613 50620 816afb 50614->50620 50616 816b76 DeviceIoControl 50615->50616 50615->50618 50617 816b98 DeviceIoControl 50616->50617 50616->50618 50617->50618 50618->50610 50626 816961 5 API calls ctype 50618->50626 50625 818191 GetModuleHandleW GetProcAddress GetDiskFreeSpaceW 50620->50625 50621 816bf9 50627 81694e SetFilePointer GetLastError 50621->50627 50624 816b24 50624->50613 50625->50624 50626->50621 50627->50610 50629 85fa00 50630 85fa04 50629->50630 50631 85fa07 malloc 50629->50631 50632 86cec0 50633 86cf26 50632->50633 50644 86d010 ResetEvent GetLastError CreateEventW GetLastError 50633->50644 50635 86cf95 50638 86cfcd 50635->50638 50645 86e980 SetEvent GetLastError 50635->50645 50637 86cfa3 50637->50638 50646 86e980 SetEvent GetLastError 50637->50646 50640 86cfb1 50640->50638 50647 86d060 50640->50647 50644->50635 50645->50637 50646->50640 50648 86d077 50647->50648 50652 86d090 50648->50652 50651 86d040 CloseHandle GetLastError WaitForSingleObject SetEvent GetLastError 50651->50638 50661 86d0f0 50652->50661 50656 86d0c1 50674 86e980 SetEvent GetLastError 50656->50674 50658 86d0cc 50675 86cb80 EnterCriticalSection LeaveCriticalSection 50658->50675 50660 86cfbd 50660->50638 50660->50651 50676 86e930 WaitForSingleObject 50661->50676 50666 86db20 27 API calls 50670 86d121 50666->50670 50668 86dc10 EnterCriticalSection LeaveCriticalSection 50668->50670 50669 86e980 SetEvent GetLastError 50669->50670 50670->50666 50670->50668 50670->50669 50671 86e930 WaitForSingleObject 50670->50671 50672 86d09d 50670->50672 50677 86da70 50670->50677 50681 86dac0 EnterCriticalSection LeaveCriticalSection 50670->50681 50682 86da30 6 API calls 50670->50682 50683 86cae0 EnterCriticalSection LeaveCriticalSection 50670->50683 50671->50670 50672->50660 50673 86e980 SetEvent GetLastError 50672->50673 50673->50656 50674->50658 50675->50660 50676->50670 50678 86dab2 50677->50678 50679 86da88 50677->50679 50678->50670 50679->50678 50684 818fdd 50679->50684 50681->50670 50682->50670 50683->50670 50685 818ff6 50684->50685 50688 81ab8a 50685->50688 50686 81900a 50686->50679 50689 81abae 50688->50689 50690 81abcd 50689->50690 50691 8193ee 7 API calls 50689->50691 50690->50686 50691->50690 50692 835844 50693 835849 __EH_prolog 50692->50693 50696 854558 50693->50696 50694 835860 50697 854562 __EH_prolog 50696->50697 50698 811c5f 2 API calls 50697->50698 50700 85456d 50698->50700 50699 854581 50699->50694 50700->50699 50702 84d52b 50700->50702 50703 84d535 __EH_prolog 50702->50703 50708 84d5df 50703->50708 50705 84d568 50706 812ac9 2 API calls 50705->50706 50707 84d58c 50706->50707 50707->50699 50709 84d5e9 __EH_prolog 50708->50709 50712 81ea53 50709->50712 50711 84d5f5 50711->50705 50713 81ea5d __EH_prolog 50712->50713 50718 81ea99 50713->50718 50715 81ea69 50723 81eaf9 malloc _CxxThrowException __EH_prolog 50715->50723 50717 81ea7f 50717->50711 50724 81890f 50718->50724 50720 81eaa6 50729 81893e GetModuleHandleW GetProcAddress 50720->50729 50722 81eacd 50722->50715 50723->50717 50734 8188fc GetCurrentProcess GetProcessAffinityMask 50724->50734 50726 81891d 50727 81892f GetSystemInfo 50726->50727 50728 818928 50726->50728 50727->50720 50728->50720 50730 818973 GlobalMemoryStatusEx 50729->50730 50731 81899e GlobalMemoryStatus 50729->50731 50730->50731 50733 81897d 50730->50733 50732 8189b7 50731->50732 50732->50733 50733->50722 50734->50726 50735 8453c3 50812 846f82 50735->50812 50739 8453e2 50740 845421 50739->50740 50741 84540a GetStdHandle GetConsoleScreenBufferInfo 50739->50741 50742 811c5f 2 API calls 50740->50742 50741->50740 50743 84542f 50742->50743 50925 83379b 9 API calls 2 library calls 50743->50925 50745 84547c 50926 847337 _CxxThrowException 50745->50926 50747 8454cc 50927 839cc1 5 API calls 2 library calls 50747->50927 50749 8454b6 _CxxThrowException 50749->50747 50750 8454f3 50751 8454f7 _CxxThrowException 50750->50751 50761 84550d 50750->50761 50751->50761 50752 845483 50752->50747 50752->50749 50753 845587 50931 811e77 fputc 50753->50931 50756 84563a _CxxThrowException 50809 845626 50756->50809 50757 8455b1 fputs 50932 811e77 fputc 50757->50932 50760 8455c7 strlen 50762 8455ea fputs fputc 50760->50762 50763 84580b 50760->50763 50761->50753 50761->50756 50928 833a87 6 API calls 2 library calls 50761->50928 50929 84796b malloc _CxxThrowException free memcpy memmove 50761->50929 50930 811c86 free 50761->50930 50762->50809 50938 811e77 fputc 50763->50938 50766 845812 fputs 50939 811e77 fputc 50766->50939 50768 8458dc 50944 811e77 fputc 50768->50944 50771 8458e3 fputs 50945 811e77 fputc 50771->50945 50772 812ac9 2 API calls 50772->50809 50775 84596f 50776 8465dd 50775->50776 50778 8465d8 50775->50778 50951 847337 _CxxThrowException 50776->50951 50777 847047 11 API calls 50777->50809 50950 847352 31 API calls __aulldiv 50778->50950 50781 812e51 malloc _CxxThrowException free _CxxThrowException 50781->50809 50784 8465e5 50952 811c86 free 50784->50952 50787 8465f0 50953 84c553 50787->50953 50788 845710 fputs 50935 8120e7 fputs 50788->50935 50792 845745 fputs 50792->50809 50793 8458f9 50793->50775 50805 845947 fputs 50793->50805 50946 84701a fputc fputs fputs fputc 50793->50946 50947 846fb3 fputc fputs 50793->50947 50948 84774a fputc fputs 50793->50948 50796 845828 50796->50768 50804 8458b0 fputs 50796->50804 50940 84701a fputc fputs fputs fputc 50796->50940 50941 8120e7 fputs 50796->50941 50942 84774a fputc fputs 50796->50942 50799 811089 4 API calls 50799->50809 50943 811e77 fputc 50804->50943 50949 811e77 fputc 50805->50949 50809->50762 50809->50763 50809->50772 50809->50777 50809->50781 50809->50788 50809->50792 50809->50799 50933 812dd6 malloc _CxxThrowException free _CxxThrowException 50809->50933 50934 812e8d malloc _CxxThrowException free _CxxThrowException 50809->50934 50936 811e77 fputc 50809->50936 50937 811c86 free 50809->50937 50813 846f8d fputs 50812->50813 50814 8453d0 50812->50814 50813->50814 50815 846fa3 fputs 50813->50815 50816 823f15 50814->50816 50815->50814 50817 823f31 50816->50817 50818 823f4e 50816->50818 51010 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50817->51010 50961 82480f 50818->50961 50821 823f40 _CxxThrowException 50821->50818 50823 823f85 50825 823f9e 50823->50825 50827 8146d9 4 API calls 50823->50827 50828 823fe6 wcscmp 50825->50828 50832 823ffa 50825->50832 50826 823f77 _CxxThrowException 50826->50823 50827->50825 50829 824002 50828->50829 50828->50832 51012 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50829->51012 50831 824011 _CxxThrowException 50831->50832 50966 825637 50832->50966 50835 825637 5 API calls 50836 824094 50835->50836 50837 8240c2 50836->50837 51013 824c43 72 API calls 2 library calls 50836->51013 50841 8240e6 50837->50841 51014 824c43 72 API calls 2 library calls 50837->51014 50840 8241d6 50975 8248c5 50840->50975 50841->50840 50842 82419c 50841->50842 51015 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50841->51015 50845 812c6c 3 API calls 50842->50845 50848 8241b3 50845->50848 50847 82418e _CxxThrowException 50847->50842 50848->50840 51016 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50848->51016 50849 82422e 50850 824257 50849->50850 50852 812c6c 3 API calls 50849->50852 50993 8146d9 50850->50993 50851 812c6c 3 API calls 50851->50849 50852->50850 50856 8241c8 _CxxThrowException 50856->50840 50858 824274 50859 8242cc 50858->50859 50860 8244f6 50858->50860 51017 8145d6 50859->51017 50861 824530 50860->50861 50874 824718 50860->50874 51032 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50860->51032 51033 82506f 10 API calls 2 library calls 50861->51033 50863 824777 50865 8247c9 50863->50865 50866 82477c 50863->50866 50873 8247d2 _CxxThrowException 50865->50873 50885 82447d 50865->50885 50870 8145d6 14 API calls 50866->50870 50869 824522 _CxxThrowException 50869->50861 50875 824789 50870->50875 50871 824543 51034 825724 50871->51034 50874->50863 50874->50885 51048 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50874->51048 51049 81458b 6 API calls 50875->51049 50879 824790 50881 8146d9 4 API calls 50879->50881 50880 824769 _CxxThrowException 50880->50863 50881->50885 50882 824358 50883 824380 50882->50883 51024 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50882->51024 50884 8243a5 50883->50884 51025 824c43 72 API calls 2 library calls 50883->51025 50890 8243c7 50884->50890 51026 824c43 72 API calls 2 library calls 50884->51026 50885->50739 50887 824604 50891 8246c7 50887->50891 50896 824666 50887->50896 51044 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50887->51044 50897 8243de 50890->50897 51027 824885 malloc _CxxThrowException free memcpy 50890->51027 50894 8246e5 50891->50894 50899 812c6c 3 API calls 50891->50899 50892 812c6c 3 API calls 50898 8245db 50892->50898 50893 824372 _CxxThrowException 50893->50883 50894->50885 51047 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50894->51047 50896->50891 50904 82468e 50896->50904 51045 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50896->51045 50902 8145d6 14 API calls 50897->50902 50898->50887 51043 8131af memmove 50898->51043 50899->50894 50905 8243e7 50902->50905 50903 824658 _CxxThrowException 50903->50896 50904->50891 51046 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50904->51046 51028 830d07 38 API calls 50905->51028 50911 82470a _CxxThrowException 50911->50874 50912 824680 _CxxThrowException 50912->50904 50913 8243ee 51029 81458b 6 API calls 50913->51029 50914 8246b9 _CxxThrowException 50914->50891 50916 8243f5 50917 812c6c 3 API calls 50916->50917 50919 82440d 50916->50919 50917->50919 50918 824456 50918->50885 50921 812c6c 3 API calls 50918->50921 50919->50885 50919->50918 51030 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50919->51030 50923 824476 50921->50923 50922 824448 _CxxThrowException 50922->50918 51031 817453 malloc _CxxThrowException free _CxxThrowException 50923->51031 50925->50745 50926->50752 50927->50750 50928->50761 50929->50761 50930->50761 50931->50757 50932->50760 50933->50809 50934->50809 50935->50809 50936->50809 50937->50809 50938->50766 50939->50796 50940->50796 50941->50796 50942->50796 50943->50796 50944->50771 50945->50793 50946->50793 50947->50793 50948->50793 50949->50793 50950->50776 50951->50784 50952->50787 50957 84c55a 50953->50957 50954 84c56c 51131 811c86 free 50954->51131 50957->50954 51132 811c86 free 50957->51132 50958 846600 50962 812b9c 2 API calls 50961->50962 50963 824822 50962->50963 51050 811c86 free 50963->51050 50965 823f60 50965->50823 51011 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50965->51011 50967 825641 __EH_prolog 50966->50967 50968 82407e 50967->50968 50969 812b9c 2 API calls 50967->50969 50968->50835 50970 82566f 50969->50970 50974 8256de 50970->50974 51051 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50970->51051 50973 8256d0 _CxxThrowException 50973->50974 51052 811c86 free 50974->51052 50976 8248cf __EH_prolog 50975->50976 50986 82491b 50976->50986 51053 812b4f 50976->51053 50979 824202 50979->50849 50979->50851 50981 8249db 51063 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50981->51063 50982 82490f 51058 811c86 free 50982->51058 50985 8249eb _CxxThrowException 50985->50979 50986->50979 50986->50981 50990 8249b4 50986->50990 51059 824ac9 58 API calls 2 library calls 50986->51059 51060 824a0a 6 API calls __EH_prolog 50986->51060 51061 824885 malloc _CxxThrowException free memcpy 50986->51061 50990->50979 51062 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 50990->51062 50992 8249cd _CxxThrowException 50992->50981 50994 8146e3 __EH_prolog 50993->50994 50995 833bfc free 50994->50995 50998 8146ef 50994->50998 50996 8146fb 50995->50996 51064 814afd malloc _CxxThrowException free memcpy ctype 50996->51064 51002 825565 50998->51002 50999 811c5f 2 API calls 51000 814709 50999->51000 51000->50998 51000->50999 51001 812b9c 2 API calls 51000->51001 51001->51000 51003 82556f __EH_prolog 51002->51003 51004 812ac9 malloc _CxxThrowException 51003->51004 51005 812c6c 3 API calls 51003->51005 51006 812c08 3 API calls 51003->51006 51008 811c86 free ctype 51003->51008 51009 825628 51003->51009 51065 8257c7 malloc _CxxThrowException free memcpy __EH_prolog 51003->51065 51004->51003 51005->51003 51006->51003 51008->51003 51009->50858 51010->50821 51011->50826 51012->50831 51013->50837 51014->50841 51015->50847 51016->50856 51018 8145e1 51017->51018 51019 814605 51017->51019 51018->51019 51066 8141c1 51018->51066 51117 814a39 free ctype 51019->51117 51022 81460d 51023 81458b 6 API calls 51022->51023 51023->50882 51024->50893 51025->50884 51026->50890 51027->50897 51028->50913 51029->50916 51030->50922 51031->50885 51032->50869 51033->50871 51035 82572e __EH_prolog 51034->51035 51036 82454f 51035->51036 51129 825a0f free ctype 51035->51129 51036->50887 51036->50892 51038 825748 51130 814afd malloc _CxxThrowException free memcpy ctype 51038->51130 51040 811c5f 2 API calls 51042 825756 51040->51042 51041 812b9c malloc _CxxThrowException 51041->51042 51042->51036 51042->51040 51042->51041 51043->50887 51044->50903 51045->50912 51046->50914 51047->50911 51048->50880 51049->50879 51050->50965 51051->50973 51052->50968 51054 812b65 51053->51054 51054->51054 51055 8128d0 2 API calls 51054->51055 51056 812b74 51055->51056 51057 824885 malloc _CxxThrowException free memcpy 51056->51057 51057->50982 51058->50986 51059->50986 51060->50986 51061->50986 51062->50992 51063->50985 51064->51000 51065->51003 51067 8141cb __EH_prolog 51066->51067 51068 8141f4 51067->51068 51069 8141df _CxxThrowException 51067->51069 51070 8139de 4 API calls 51068->51070 51069->51068 51071 814208 51070->51071 51072 814227 51071->51072 51118 8147a5 free ctype 51071->51118 51074 812ac9 2 API calls 51072->51074 51075 814231 51074->51075 51076 81426a 51075->51076 51078 814257 wcscmp 51075->51078 51077 814338 51076->51077 51119 81449d wcscmp wcscmp 51076->51119 51121 814102 wcscmp 51077->51121 51078->51076 51081 814346 51083 812b9c 2 API calls 51081->51083 51086 81439d 51081->51086 51082 8142b0 wcscmp 51084 814287 51082->51084 51085 8142c6 wcscmp 51082->51085 51087 81435b 51083->51087 51084->51082 51098 8142e1 51084->51098 51085->51084 51089 833bfc free 51086->51089 51113 8143e3 51086->51113 51122 81446d malloc _CxxThrowException 51087->51122 51088 8146d9 4 API calls 51093 81440e 51088->51093 51094 8143c1 51089->51094 51091 81436a 51123 814981 malloc _CxxThrowException free memcpy __EH_prolog 51091->51123 51092 812e51 4 API calls 51092->51098 51127 813d95 6 API calls 2 library calls 51093->51127 51097 812b4f 2 API calls 51094->51097 51102 8143ce 51097->51102 51098->51077 51098->51092 51100 811089 4 API calls 51098->51100 51120 8147cb free memmove ctype 51098->51120 51099 81437d 51124 813e8d free __EH_prolog ctype 51099->51124 51100->51098 51101 81443b 51105 83ed1c ctype free 51101->51105 51103 81150c 4 API calls 51102->51103 51106 8143db 51103->51106 51109 814447 51105->51109 51126 811c86 free 51106->51126 51107 81438e 51125 811c86 free 51107->51125 51128 811c86 free 51109->51128 51113->51088 51114 81444f 51115 83ed1c ctype free 51114->51115 51116 81445c 51115->51116 51116->51018 51117->51022 51118->51072 51119->51084 51120->51098 51121->51081 51122->51091 51123->51099 51124->51107 51125->51086 51126->51113 51127->51101 51128->51114 51129->51038 51130->51042 51131->50958 51132->50957 51133 8357c9 51134 835828 51133->51134 51136 8357cd 51133->51136 51136->51134 51137 83ac80 11 API calls 2 library calls 51136->51137 51137->51134 51138 84674e 51139 846758 __EH_prolog 51138->51139 51140 812ac9 2 API calls 51139->51140 51141 846796 51140->51141 51142 812ac9 2 API calls 51141->51142 51143 8467a2 51142->51143 51144 812ac9 2 API calls 51143->51144 51145 8467d5 51144->51145 51152 8466de 51145->51152 51147 8467ef 51156 84688e 51147->51156 51150 812ac9 2 API calls 51151 846853 51150->51151 51153 8466e8 __EH_prolog 51152->51153 51154 812ac9 2 API calls 51153->51154 51155 84670b 51154->51155 51155->51147 51157 846898 __EH_prolog 51156->51157 51170 825213 malloc _CxxThrowException __EH_prolog 51157->51170 51159 8468c3 51160 812ac9 2 API calls 51159->51160 51161 8468de 51160->51161 51162 812ac9 2 API calls 51161->51162 51163 8468ff 51162->51163 51164 812ac9 2 API calls 51163->51164 51165 846920 51164->51165 51166 812ac9 2 API calls 51165->51166 51167 84692f 51166->51167 51168 812ac9 2 API calls 51167->51168 51169 84682a 51168->51169 51169->51150 51170->51159 51171 823bcf 51172 823bd9 __EH_prolog 51171->51172 51199 8113e5 51172->51199 51175 823c10 6 API calls 51180 823c6f 51175->51180 51177 823c02 _CxxThrowException 51177->51175 51178 823d2b 51212 823ec2 51178->51212 51180->51178 51216 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 51180->51216 51184 823d59 _CxxThrowException 51184->51178 51200 8113ef __EH_prolog 51199->51200 51201 833bfc free 51200->51201 51202 81141b 51201->51202 51203 811428 51202->51203 51217 81120b free ctype 51202->51217 51204 811c5f 2 API calls 51203->51204 51209 81143d 51204->51209 51206 8114dc 51206->51175 51215 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 51206->51215 51207 81150c 4 API calls 51207->51209 51209->51206 51209->51207 51210 8114ef 51209->51210 51218 81125e 4 API calls 2 library calls 51209->51218 51211 812c6c 3 API calls 51210->51211 51211->51206 51219 818252 GetCurrentProcess OpenProcessToken 51212->51219 51215->51177 51216->51184 51217->51203 51218->51209 51220 818279 LookupPrivilegeValueW 51219->51220 51221 8182cf 51219->51221 51222 8182c1 51220->51222 51223 81828b AdjustTokenPrivileges 51220->51223 51224 8182c4 FindCloseChangeNotification 51222->51224 51223->51222 51225 8182b1 GetLastError 51223->51225 51224->51221 51225->51224 51226 81904e 51227 81905d 51226->51227 51229 819063 51226->51229 51228 81c591 112 API calls 51227->51228 51228->51229 51230 84e6d7 51231 84e6e1 __EH_prolog 51230->51231 51238 850c28 51231->51238 51233 84e75e 51235 84e765 51233->51235 51246 852bb0 51233->51246 51236 84e7d1 51236->51235 51252 8541e7 9 API calls 2 library calls 51236->51252 51239 850c3a 51238->51239 51253 8196ec 51239->51253 51241 850c85 51241->51233 51242 850c62 51242->51241 51259 8509f6 51242->51259 51245 8196ec 3 API calls 51245->51242 51247 852bba __EH_prolog 51246->51247 51276 852786 51247->51276 51250 852bf1 _CxxThrowException 51250->51236 51251 852c28 51251->51236 51252->51235 51254 8196f8 51253->51254 51257 81970c 51253->51257 51255 8168bb 2 API calls 51254->51255 51254->51257 51256 819776 51255->51256 51271 81966e GetLastError 51256->51271 51257->51241 51257->51245 51260 850a00 __EH_prolog 51259->51260 51272 81c56f 51260->51272 51262 850a2a 51262->51241 51263 850a17 51263->51262 51264 811c5f 2 API calls 51263->51264 51265 850a51 memcpy 51264->51265 51269 850a6f 51265->51269 51266 850b2e 51275 811c86 free 51266->51275 51267 850b10 memmove 51267->51269 51269->51266 51269->51267 51270 850b33 memcpy 51269->51270 51270->51266 51271->51257 51273 81c523 7 API calls 51272->51273 51274 81c582 51273->51274 51274->51263 51275->51262 51277 852790 __EH_prolog 51276->51277 51308 84e900 51277->51308 51279 8529a4 51279->51250 51279->51251 51280 8528b0 51280->51279 51307 8196ec 3 API calls 51280->51307 51281 852a3e 51281->51279 51283 811c5f 2 API calls 51281->51283 51285 852a63 51283->51285 51284 81c56f 7 API calls 51284->51280 51286 81c56f 7 API calls 51285->51286 51287 852a7a 51286->51287 51290 852a9a 51287->51290 51300 852a7e 51287->51300 51350 8507ab _CxxThrowException 51287->51350 51315 85088b 51290->51315 51293 852b5a 51354 852063 155 API calls 2 library calls 51293->51354 51295 852aec 51319 851ddb 51295->51319 51298 852b1f 51299 83ed1c ctype free 51298->51299 51299->51300 51355 811c86 free 51300->51355 51307->51281 51356 84e985 51308->51356 51310 84e936 51363 811c86 free 51310->51363 51312 84e952 51364 811c86 free 51312->51364 51314 84e965 51314->51279 51314->51280 51314->51284 51316 8508a7 51315->51316 51317 8508b6 51316->51317 51392 8507ab _CxxThrowException 51316->51392 51317->51293 51317->51295 51351 8507ab _CxxThrowException 51317->51351 51320 851de5 __EH_prolog 51319->51320 51393 851b7b 51320->51393 51322 851f97 51511 84d1c9 51322->51511 51326 852003 _CxxThrowException 51328 852017 51326->51328 51332 84d1c9 free 51328->51332 51334 852034 51332->51334 51522 811c86 free 51334->51522 51335 811c5f 2 API calls 51348 851e42 51335->51348 51339 85203c 51523 811c86 free 51339->51523 51343 852044 51524 811c86 free 51343->51524 51348->51322 51348->51326 51348->51328 51348->51335 51419 81c682 51348->51419 51424 8173f7 51348->51424 51430 84987f 51348->51430 51517 8507ab _CxxThrowException 51348->51517 51350->51290 51351->51295 51354->51298 51355->51279 51365 84ea01 51356->51365 51359 84e9a7 51382 811c86 free 51359->51382 51362 84e9be 51362->51310 51363->51312 51364->51314 51384 811c86 free 51365->51384 51367 84ea11 51385 811c86 free 51367->51385 51369 84ea25 51386 811c86 free 51369->51386 51371 84ea30 51387 811c86 free 51371->51387 51373 84ea3b 51388 811c86 free 51373->51388 51375 84ea46 51389 811c86 free 51375->51389 51377 84ea51 51390 811c86 free 51377->51390 51379 84ea5c 51380 84e98f 51379->51380 51391 811c86 free 51379->51391 51380->51359 51383 811c86 free 51380->51383 51382->51362 51383->51359 51384->51367 51385->51369 51386->51371 51387->51373 51388->51375 51389->51377 51390->51379 51391->51380 51392->51317 51394 85088b _CxxThrowException 51393->51394 51395 851b8d 51394->51395 51396 85088b _CxxThrowException 51395->51396 51413 851bbf 51395->51413 51399 851ba7 51396->51399 51397 851be4 51398 851c02 51397->51398 51528 852c39 malloc _CxxThrowException free ctype 51397->51528 51400 851c32 51398->51400 51404 851c17 51398->51404 51526 85112e 5 API calls 2 library calls 51399->51526 51530 858971 malloc _CxxThrowException free ctype 51400->51530 51529 8517e2 6 API calls 2 library calls 51404->51529 51406 851bdc 51409 85088b _CxxThrowException 51406->51409 51407 851bb7 51410 85088b _CxxThrowException 51407->51410 51409->51397 51410->51413 51411 851c25 51414 85088b _CxxThrowException 51411->51414 51412 851c2d 51415 851c77 51412->51415 51532 8507ab _CxxThrowException 51412->51532 51413->51397 51527 851231 19 API calls 2 library calls 51413->51527 51414->51412 51415->51348 51416 851c3f 51416->51412 51531 83ed51 malloc _CxxThrowException free memcpy 51416->51531 51420 811c5f 2 API calls 51419->51420 51421 81c68d 51420->51421 51422 822914 4 API calls 51421->51422 51423 81c6a3 51422->51423 51423->51348 51425 817404 51424->51425 51426 817422 51424->51426 51427 817410 51425->51427 51533 811c86 free 51425->51533 51426->51348 51427->51426 51429 811c5f 2 API calls 51427->51429 51429->51426 51431 849889 __EH_prolog 51430->51431 51534 850f48 51431->51534 51512 84d1d3 __EH_prolog 51511->51512 51670 811c86 free 51512->51670 51514 84d1fa 51671 8211b3 free ctype 51514->51671 51516 84d202 51518 811c86 free 51516->51518 51517->51348 51522->51339 51523->51343 51526->51407 51527->51406 51528->51398 51529->51411 51530->51416 51531->51416 51532->51415 51533->51427 51599 850cd2 51534->51599 51626 850982 51599->51626 51627 85088b _CxxThrowException 51626->51627 51629 85098b 51627->51629 51628 850996 _CxxThrowException 51630 8509aa 51628->51630 51629->51628 51629->51630 51670->51514 51671->51516 51672 85fb53 VirtualFree 51673 838c14 51674 838c1c 51673->51674 51701 838e00 51673->51701 51674->51701 51720 8387b6 VariantClear 51674->51720 51676 838c75 51676->51701 51721 8387b6 VariantClear 51676->51721 51678 838c90 51678->51701 51722 8387b6 VariantClear 51678->51722 51680 838ca9 51680->51701 51723 8387b6 VariantClear 51680->51723 51682 838cc2 51682->51701 51724 8387b6 VariantClear 51682->51724 51684 838cdb 51684->51701 51725 8387b6 VariantClear 51684->51725 51686 838cf4 51686->51701 51726 813b1b malloc _CxxThrowException 51686->51726 51688 838d07 51689 812ac9 2 API calls 51688->51689 51691 838d12 51689->51691 51690 838d34 51694 838db4 51690->51694 51695 838d64 51690->51695 51714 838daf 51690->51714 51691->51690 51692 812c08 3 API calls 51691->51692 51692->51690 51731 8335d1 CharUpperW 51694->51731 51698 812ac9 2 API calls 51695->51698 51696 838df8 51735 811c86 free 51696->51735 51700 838d6c 51698->51700 51703 812ac9 2 API calls 51700->51703 51702 838dbf 51732 82f1d9 4 API calls 2 library calls 51702->51732 51705 838d7a 51703->51705 51727 82f1d9 4 API calls 2 library calls 51705->51727 51706 838ddb 51708 812c6c 3 API calls 51706->51708 51710 838de7 51708->51710 51709 838d8b 51711 812c6c 3 API calls 51709->51711 51733 811c86 free 51710->51733 51713 838d97 51711->51713 51728 811c86 free 51713->51728 51734 811c86 free 51714->51734 51716 838d9f 51729 811c86 free 51716->51729 51718 838da7 51730 811c86 free 51718->51730 51720->51676 51721->51678 51722->51680 51723->51682 51724->51684 51725->51686 51726->51688 51727->51709 51728->51716 51729->51718 51730->51714 51731->51702 51732->51706 51733->51714 51734->51696 51735->51701 51736 87539d __setusermatherr 51737 8753a9 51736->51737 51742 875454 _controlfp 51737->51742 51739 8753ae _initterm __getmainargs _initterm __p___initenv 51740 847b3e 51739->51740 51741 875409 exit _XcptFilter 51740->51741 51742->51739 51743 84d6e4 51744 84d702 51743->51744 51745 84d6f1 51743->51745 51745->51744 51749 84d709 51745->51749 51750 84d713 __EH_prolog 51749->51750 51764 811c86 free 51750->51764 51752 84d72d 51765 811c86 free 51752->51765 51754 84d738 51766 811c86 free 51754->51766 51756 84d743 51767 84d7cc free ctype 51756->51767 51758 84d751 51768 81eb3a free VariantClear ctype 51758->51768 51760 84d77d 51769 82086b free VariantClear __EH_prolog ctype 51760->51769 51762 84d6fc 51763 811c86 free 51762->51763 51763->51744 51764->51752 51765->51754 51766->51756 51767->51758 51768->51760 51769->51762 51770 846be7 51771 846c11 51770->51771 51772 846c00 51770->51772 51772->51771 51776 846cb3 51772->51776 51788 811c86 free 51776->51788 51778 846cc1 51789 811c86 free 51778->51789 51780 846ccc 51790 811c86 free 51780->51790 51782 846cd7 51791 811c86 free 51782->51791 51784 846ceb 51792 847ffa 51784->51792 51787 811c86 free 51787->51771 51788->51778 51789->51780 51790->51782 51791->51784 51793 848004 __EH_prolog 51792->51793 51794 848093 6 API calls 51793->51794 51795 848019 51794->51795 51810 811c86 free 51795->51810 51797 848024 51811 831ce2 51797->51811 51801 848039 51817 811c86 free 51801->51817 51803 848041 51818 811c86 free 51803->51818 51805 848049 51819 811c86 free 51805->51819 51807 848051 51808 831ce2 free 51807->51808 51809 846c0b 51808->51809 51809->51787 51810->51797 51820 811c86 free 51811->51820 51813 831ced 51821 811c86 free 51813->51821 51815 831cf5 51816 811c86 free 51815->51816 51816->51801 51817->51803 51818->51805 51819->51807 51820->51813 51821->51815 51825 85fa20 free 51826 85c760 51828 85c774 51826->51828 51830 85c987 51826->51830 51829 81c591 112 API calls 51828->51829 51828->51830 51831 81ab8a 7 API calls 51828->51831 51832 8676c0 memcpy 51828->51832 51829->51828 51831->51828 51832->51828 51833 8390e9 51834 839110 51833->51834 51835 818570 VariantClear 51834->51835 51836 839151 51835->51836 51837 8395a9 2 API calls 51836->51837 51838 8391d8 51837->51838 51912 834c14 51838->51912 51841 8349cf VariantClear 51844 83920a 51841->51844 51929 831b4c 51844->51929 51845 812c6c 3 API calls 51846 8392bb 51845->51846 51847 8392f4 51846->51847 51848 839468 51846->51848 51849 8394ff 51847->51849 51933 8351e3 51847->51933 51960 838a62 malloc _CxxThrowException free 51848->51960 51963 811c86 free 51849->51963 51851 83947a 51854 812c6c 3 API calls 51851->51854 51857 839489 51854->51857 51855 839507 51964 811c86 free 51855->51964 51961 811c86 free 51857->51961 51859 83931f 51937 839db6 51859->51937 51861 83950f 51864 83230d free 51861->51864 51863 839491 51962 811c86 free 51863->51962 51874 8393c0 51864->51874 51868 839336 51946 811c86 free 51868->51946 51869 839499 51871 83230d free 51869->51871 51871->51874 51872 83933e 51947 83230d 51872->51947 51876 812c6c malloc _CxxThrowException free 51879 838fd7 51876->51879 51878 83938b 51880 8393b1 51878->51880 51959 838a62 malloc _CxxThrowException free 51878->51959 51879->51874 51879->51876 51879->51878 51881 839db6 4 API calls 51879->51881 51884 83230d free 51879->51884 51887 8395a9 51879->51887 51899 838e15 51879->51899 51883 83230d free 51880->51883 51881->51879 51883->51874 51884->51879 51885 8393a2 51886 812c6c 3 API calls 51885->51886 51886->51880 51888 8395b3 __EH_prolog 51887->51888 51965 831c3a 51888->51965 51891 831c3a 2 API calls 51892 8395e3 51891->51892 51893 812ac9 2 API calls 51892->51893 51894 8395ef 51893->51894 51895 812ac9 2 API calls 51894->51895 51896 8395fb 51895->51896 51897 812ac9 2 API calls 51896->51897 51898 83960a 51897->51898 51898->51879 51900 838e1f __EH_prolog 51899->51900 51901 838e6b 51900->51901 51902 838e3e 51900->51902 51904 811c5f 2 API calls 51901->51904 51911 838e45 51901->51911 51903 811c5f 2 API calls 51902->51903 51903->51911 51905 838e7b 51904->51905 51906 812c6c 3 API calls 51905->51906 51907 838eab 51906->51907 51971 816c63 21 API calls 51907->51971 51909 838eb5 51910 838eb9 GetLastError 51909->51910 51909->51911 51910->51911 51911->51879 51918 834c1e __EH_prolog 51912->51918 51913 834cd7 51916 834cef 51913->51916 51919 834ce3 51913->51919 51920 834d1f 51913->51920 51914 834cca 51915 818570 VariantClear 51914->51915 51917 834cd2 51915->51917 51916->51920 51921 834ced 51916->51921 51917->51841 51927 834c71 51918->51927 51972 812883 malloc _CxxThrowException free _CxxThrowException ctype 51918->51972 51973 812d17 malloc _CxxThrowException free SysStringLen ctype 51919->51973 51922 818570 VariantClear 51920->51922 51925 818570 VariantClear 51921->51925 51922->51917 51926 834d09 51925->51926 51926->51917 51974 834d3d 5 API calls __EH_prolog 51926->51974 51927->51913 51927->51914 51927->51917 51930 831b5c 51929->51930 51931 812ac9 2 API calls 51930->51931 51932 831b79 51931->51932 51932->51845 51934 8351ed __EH_prolog 51933->51934 51935 818570 VariantClear 51934->51935 51936 835270 51935->51936 51936->51849 51936->51859 51938 839dc0 __EH_prolog 51937->51938 51939 811c5f 2 API calls 51938->51939 51940 839dce 51939->51940 51941 839de5 51940->51941 51975 83a060 malloc _CxxThrowException __EH_prolog 51940->51975 51943 822914 4 API calls 51941->51943 51944 83932e 51943->51944 51945 811c86 free 51944->51945 51945->51868 51946->51872 51948 832317 __EH_prolog 51947->51948 51976 811c86 free 51948->51976 51950 832330 51977 811c86 free 51950->51977 51952 832338 51978 811c86 free 51952->51978 51954 832340 51955 831ce2 free 51954->51955 51956 83234b 51955->51956 51957 831ce2 free 51956->51957 51958 832353 51957->51958 51958->51879 51959->51885 51960->51851 51961->51863 51962->51869 51963->51855 51964->51861 51966 831c44 __EH_prolog 51965->51966 51967 812ac9 2 API calls 51966->51967 51968 831c71 51967->51968 51969 812ac9 2 API calls 51968->51969 51970 831c7c 51969->51970 51970->51891 51971->51909 51972->51927 51973->51921 51974->51917 51975->51941 51976->51950 51977->51952 51978->51954 51979 847ba8 51980 847dfa 51979->51980 51983 84109b SetConsoleCtrlHandler 51980->51983 51982 847e06 51983->51982 51984 845de8 51985 845e05 51984->51985 51986 845df1 fputs 51984->51986 52141 8410af 51985->52141 52140 811e77 fputc 51986->52140 51990 812ac9 2 API calls 51991 845e60 51990->51991 52145 830a6a 51991->52145 51993 845e88 52205 811c86 free 51993->52205 51995 845e97 51996 845ead 51995->51996 51997 848093 6 API calls 51995->51997 51998 845ecd 51996->51998 52206 84145c 51996->52206 51997->51996 51999 847ffa 6 API calls 51998->51999 52001 845edc 51999->52001 52003 811c5f 2 API calls 52001->52003 52118 84649d 52001->52118 52002 83ed1c ctype free 52004 8465ba 52002->52004 52005 845ef9 52003->52005 52006 83ed1c ctype free 52004->52006 52008 845f0c 52005->52008 52313 846a99 malloc _CxxThrowException __EH_prolog 52005->52313 52007 8465c6 52006->52007 52009 8465dd 52007->52009 52011 8465d8 52007->52011 52015 812c6c 3 API calls 52008->52015 52360 847337 _CxxThrowException 52009->52360 52359 847352 31 API calls __aulldiv 52011->52359 52014 8465e5 52361 811c86 free 52014->52361 52019 845f45 52015->52019 52017 8465f0 52018 84c553 free 52017->52018 52020 846600 52018->52020 52216 8466bb 52019->52216 52362 8111bb free __EH_prolog ctype 52020->52362 52025 846620 52363 847772 free __EH_prolog ctype 52025->52363 52028 84662f 52030 83ed1c ctype free 52028->52030 52029 825724 4 API calls 52031 845fed 52029->52031 52032 84663b 52030->52032 52033 812ac9 2 API calls 52031->52033 52034 845ff5 52033->52034 52222 833309 52034->52222 52037 846035 52228 83125a 52037->52228 52040 84602e 52315 847337 _CxxThrowException 52040->52315 52043 846095 52045 8460d5 52043->52045 52316 811e77 fputc 52043->52316 52044 848093 6 API calls 52044->52043 52046 846151 52045->52046 52336 811e77 fputc 52045->52336 52047 84618c 52046->52047 52050 846167 fputs 52046->52050 52051 8460f6 52051->52046 52053 8460ad fputs 52317 811e77 fputc 52053->52317 52118->52002 52140->51985 52142 8410c5 52141->52142 52143 8410b8 52141->52143 52142->51990 52364 812579 malloc _CxxThrowException free ctype 52143->52364 52146 830a74 __EH_prolog 52145->52146 52365 82f640 52146->52365 52151 830acb 52152 830ca5 free 52151->52152 52155 830ad9 52152->52155 52153 830b3d 52379 830ca5 52153->52379 52157 83ed1c ctype free 52155->52157 52159 830ae5 52157->52159 52159->51993 52161 81150c 4 API calls 52167 830aed 52161->52167 52162 830b60 _CxxThrowException 52172 830b6e 52162->52172 52163 830bbe 52393 83aeda 52163->52393 52166 812ac9 2 API calls 52166->52172 52167->52153 52167->52161 52396 82f593 malloc _CxxThrowException free _CxxThrowException 52167->52396 52397 811c86 free 52167->52397 52168 830bd6 52169 833bfc free 52168->52169 52171 830be1 52169->52171 52173 822d6d 3 API calls 52171->52173 52172->52163 52172->52166 52174 81150c 4 API calls 52172->52174 52399 81586b 52172->52399 52403 811c86 free 52172->52403 52175 830bea 52173->52175 52174->52172 52176 833bfc free 52175->52176 52178 830bf7 52176->52178 52179 822d6d 3 API calls 52178->52179 52186 830bff 52179->52186 52180 830c4f 52405 811c86 free 52180->52405 52182 830fdb malloc _CxxThrowException 52182->52186 52183 830c57 52184 83ed1c ctype free 52183->52184 52185 830c64 52184->52185 52187 83ed1c ctype free 52185->52187 52186->52180 52186->52182 52189 830c83 52186->52189 52404 8139c5 wcscmp 52186->52404 52187->52159 52406 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 52189->52406 52191 830c97 _CxxThrowException 52192 830ca5 __EH_prolog 52191->52192 52407 811c86 free 52192->52407 52194 830cc8 52408 82f705 52194->52408 52200 830ce5 52423 811c86 free 52200->52423 52202 830ced 52205->51995 52207 841466 __EH_prolog 52206->52207 52215 8414a8 52207->52215 52582 8124f8 52207->52582 52213 8414a0 52602 811c86 free 52213->52602 52215->51998 52217 8466de 2 API calls 52216->52217 52218 845f97 52217->52218 52219 84788b 52218->52219 52220 812c6c 3 API calls 52219->52220 52221 845fad 52220->52221 52221->52029 52223 833313 __EH_prolog 52222->52223 52224 812ac9 2 API calls 52223->52224 52225 833337 52224->52225 52226 812ac9 2 API calls 52225->52226 52227 833343 52226->52227 52227->52037 52314 8327aa 19 API calls 2 library calls 52227->52314 52235 831264 __EH_prolog 52228->52235 52229 831370 52230 831389 52229->52230 52232 811c5f 2 API calls 52229->52232 52231 811c5f 2 API calls 52230->52231 52234 8313b6 52231->52234 52232->52230 52233 812ac9 2 API calls 52233->52235 52236 8313c9 52234->52236 52619 825e79 52234->52619 52235->52229 52235->52233 52237 8160c0 36 API calls 52235->52237 52240 8313cd _CxxThrowException 52235->52240 52243 8313e2 _CxxThrowException 52235->52243 52806 83ed51 malloc _CxxThrowException free memcpy 52235->52806 52807 811c86 free 52235->52807 52635 831cf9 52236->52635 52237->52235 52240->52243 52243->52236 52244 831aa2 52822 811c86 free 52244->52822 52245 831894 52245->52244 52258 831498 52245->52258 52247 812ac9 malloc _CxxThrowException 52262 83147c 52247->52262 52249 831b2f 52823 811c86 free 52249->52823 52250 831a91 52821 811c86 free 52250->52821 52253 831a99 52253->52043 52253->52044 52254 831a4f _CxxThrowException 52254->52245 52255 8318d4 52809 811c86 free 52255->52809 52820 811c86 free 52258->52820 52260 831b4c 2 API calls 52260->52262 52261 812c6c 3 API calls 52261->52262 52262->52245 52262->52247 52262->52254 52262->52255 52262->52258 52262->52260 52262->52261 52263 8318f3 52262->52263 52266 83193b 52262->52266 52276 84c553 free 52262->52276 52282 8319c7 52262->52282 52284 8160c0 36 API calls 52262->52284 52287 831981 52262->52287 52288 811c86 free ctype 52262->52288 52289 831a0a 52262->52289 52309 811e77 fputc 52262->52309 52639 841d54 52262->52639 52651 831be0 52262->52651 52657 832270 52262->52657 52663 842029 52262->52663 52706 831d93 52262->52706 52794 831c8c 52262->52794 52808 831211 wcscmp 52262->52808 52810 811c86 free 52263->52810 52265 8318fe 52267 84c553 free 52265->52267 52812 811c86 free 52266->52812 52268 83190b 52267->52268 52270 831c8c free 52268->52270 52272 83191a 52270->52272 52271 831946 52273 84c553 free 52271->52273 52811 811c86 free 52272->52811 52275 831953 52273->52275 52279 831c8c free 52275->52279 52276->52262 52280 831962 52279->52280 52813 811c86 free 52280->52813 52816 811c86 free 52282->52816 52284->52262 52286 8319d2 52290 84c553 free 52286->52290 52814 811c86 free 52287->52814 52288->52262 52818 811c86 free 52289->52818 52292 8319df 52290->52292 52295 831c8c free 52292->52295 52293 83198c 52296 84c553 free 52293->52296 52298 8319ee 52295->52298 52299 831999 52296->52299 52297 831a15 52300 84c553 free 52297->52300 52817 811c86 free 52298->52817 52303 831c8c free 52299->52303 52301 831a22 52300->52301 52304 831c8c free 52301->52304 52305 8319a8 52303->52305 52306 831a31 52304->52306 52815 811c86 free 52305->52815 52819 811c86 free 52306->52819 52309->52262 52313->52008 52314->52040 52315->52037 52316->52053 52336->52051 52359->52009 52360->52014 52361->52017 52362->52025 52363->52028 52364->52142 52366 82f64a __EH_prolog 52365->52366 52424 825a91 52366->52424 52369 82f931 52375 82f93b __EH_prolog 52369->52375 52370 82f9e1 52530 82f5e9 malloc _CxxThrowException free memcpy 52370->52530 52372 82f9e9 52531 830793 11 API calls 2 library calls 52372->52531 52374 82f9f1 52374->52151 52374->52167 52375->52370 52375->52374 52376 82f60b malloc _CxxThrowException free memcpy 52375->52376 52378 83ed1c ctype free 52375->52378 52440 82fa08 52375->52440 52376->52375 52378->52375 52380 830caf __EH_prolog 52379->52380 52574 811c86 free 52380->52574 52382 830cc8 52383 82f705 free 52382->52383 52384 830cd1 52383->52384 52385 8310c6 free 52384->52385 52386 830cdd 52385->52386 52575 811c86 free 52386->52575 52388 830ce5 52576 811c86 free 52388->52576 52390 830ced 52391 83ed1c ctype free 52390->52391 52392 830b4c 52391->52392 52392->52172 52398 830f43 malloc _CxxThrowException free _CxxThrowException __EH_prolog 52392->52398 52394 822d6d 3 API calls 52393->52394 52395 83aeec 52394->52395 52395->52168 52396->52167 52397->52167 52398->52162 52400 818184 52399->52400 52401 817fcc 6 API calls 52400->52401 52402 818190 52401->52402 52402->52172 52403->52172 52404->52186 52405->52183 52406->52191 52407->52194 52577 811c86 free 52408->52577 52410 82f710 52578 811c86 free 52410->52578 52412 82f718 52413 83ed1c ctype free 52412->52413 52414 82f721 52413->52414 52415 8310c6 52414->52415 52416 8310ee 52415->52416 52420 8310d1 52415->52420 52579 811c86 free 52416->52579 52418 830cdd 52422 811c86 free 52418->52422 52420->52416 52580 82f42b free ctype 52420->52580 52581 811c86 free 52420->52581 52422->52200 52423->52202 52435 874f50 52424->52435 52426 825a9b GetCurrentProcess 52436 825b2f 52426->52436 52428 825ab8 OpenProcessToken 52429 825ac9 LookupPrivilegeValueW 52428->52429 52430 825b0e 52428->52430 52429->52430 52432 825aeb AdjustTokenPrivileges 52429->52432 52431 825b2f FindCloseChangeNotification 52430->52431 52433 825b1a 52431->52433 52432->52430 52434 825b00 GetLastError 52432->52434 52433->52369 52434->52430 52435->52426 52437 825b38 52436->52437 52438 825b3c FindCloseChangeNotification 52436->52438 52437->52428 52439 825b4c 52438->52439 52439->52428 52442 82fa12 __EH_prolog 52440->52442 52441 82feb1 52441->52375 52442->52441 52449 82ff29 52442->52449 52524 82fa70 52442->52524 52443 8300c1 52444 812ac9 2 API calls 52443->52444 52445 8300da 52444->52445 52564 81660f malloc _CxxThrowException free _CxxThrowException 52445->52564 52447 8300ef 52454 812ac9 2 API calls 52447->52454 52448 82ffaa 52560 8166a3 6 API calls 2 library calls 52448->52560 52449->52443 52449->52448 52450 82fea9 52555 811c86 free 52450->52555 52452 812a6e 2 API calls 52452->52524 52491 830102 52454->52491 52455 812a6e 2 API calls 52513 82fd6c 52455->52513 52456 830085 52457 83ed1c ctype free 52456->52457 52457->52441 52458 812b9c 2 API calls 52508 82ffc2 52458->52508 52460 83009b 52563 811c86 free 52460->52563 52462 812ac9 2 API calls 52462->52524 52463 830189 52568 82f470 GetLastError 52463->52568 52464 812ac9 2 API calls 52464->52513 52467 830197 52569 811c86 free 52467->52569 52469 811089 4 API calls 52469->52524 52470 8300a8 52474 83ed1c ctype free 52470->52474 52471 830193 52471->52467 52475 8301bb 52471->52475 52473 812ac9 2 API calls 52473->52508 52474->52441 52571 811c86 free 52475->52571 52476 83019f 52570 811c86 free 52476->52570 52478 812c6c 3 API calls 52478->52524 52479 83072b 4 API calls 52479->52513 52482 8160c0 36 API calls 52482->52524 52484 8301c5 52572 811c86 free 52484->52572 52485 812c6c 3 API calls 52485->52513 52486 812c6c 3 API calls 52486->52508 52487 8301ab 52490 815c6d FindClose 52487->52490 52490->52441 52491->52463 52491->52467 52491->52475 52503 812ac9 2 API calls 52491->52503 52565 816677 11 API calls 52491->52565 52566 83049f 58 API calls 2 library calls 52491->52566 52567 811c86 free 52491->52567 52492 8160c0 36 API calls 52492->52513 52493 8301d0 52498 815c6d FindClose 52493->52498 52497 811089 4 API calls 52497->52513 52498->52441 52499 83ed1c ctype free 52499->52513 52500 82fdda 52553 811c86 free 52500->52553 52501 830096 52562 811c86 free 52501->52562 52503->52491 52504 811c86 free ctype 52504->52508 52505 811c86 free ctype 52505->52524 52507 82ff07 52557 811c86 free 52507->52557 52508->52456 52508->52458 52508->52460 52508->52473 52508->52486 52508->52501 52508->52504 52561 83049f 58 API calls 2 library calls 52508->52561 52511 82fdeb 52558 811c86 free 52511->52558 52513->52450 52513->52455 52513->52464 52513->52479 52513->52485 52513->52492 52513->52497 52513->52499 52513->52507 52515 811c86 free ctype 52513->52515 52552 812bca malloc _CxxThrowException free ctype 52513->52552 52554 830218 58 API calls 2 library calls 52513->52554 52556 82f470 GetLastError 52513->52556 52515->52513 52516 82ff19 52559 811c86 free 52516->52559 52522 81150c malloc _CxxThrowException free memcpy 52522->52524 52524->52452 52524->52462 52524->52469 52524->52478 52524->52482 52524->52500 52524->52505 52524->52513 52524->52522 52525 82fdde 52524->52525 52529 83ed1c free ctype 52524->52529 52532 83072b 52524->52532 52542 812bca malloc _CxxThrowException free ctype 52524->52542 52543 82f470 GetLastError 52524->52543 52544 81402e 7 API calls 52524->52544 52545 82f723 11 API calls 52524->52545 52546 82f31d 5 API calls __EH_prolog 52524->52546 52547 82f835 14 API calls 2 library calls 52524->52547 52548 8302b2 20 API calls 2 library calls 52524->52548 52549 813d45 wcscmp 52524->52549 52550 822dac malloc _CxxThrowException free memcpy ctype 52524->52550 52551 830218 58 API calls 2 library calls 52524->52551 52527 83ed1c ctype free 52525->52527 52527->52500 52529->52524 52530->52372 52531->52374 52533 830735 __EH_prolog 52532->52533 52534 812b9c 2 API calls 52533->52534 52535 830745 52534->52535 52536 812e51 4 API calls 52535->52536 52537 830753 52536->52537 52538 811089 4 API calls 52537->52538 52539 83075d 52538->52539 52573 811c86 free 52539->52573 52541 830782 52541->52524 52542->52524 52543->52524 52544->52524 52545->52524 52546->52524 52547->52524 52548->52524 52549->52524 52550->52524 52551->52524 52552->52513 52553->52511 52554->52513 52555->52441 52556->52513 52557->52511 52558->52516 52559->52441 52560->52508 52561->52508 52562->52460 52563->52470 52564->52447 52565->52491 52566->52491 52567->52491 52568->52471 52569->52476 52570->52487 52571->52484 52572->52493 52573->52541 52574->52382 52575->52388 52576->52390 52577->52410 52578->52412 52579->52418 52580->52420 52581->52420 52583 811c5f 2 API calls 52582->52583 52584 812505 52583->52584 52585 841306 52584->52585 52586 84133f 52585->52586 52587 841317 52585->52587 52603 8411f4 52586->52603 52589 8411f4 6 API calls 52587->52589 52590 841333 52589->52590 52592 8126a4 6 API calls 52590->52592 52592->52586 52595 84139c fputs 52601 811e77 fputc 52595->52601 52597 84137d 52598 8411f4 6 API calls 52597->52598 52599 84138f 52598->52599 52600 8412d9 6 API calls 52599->52600 52600->52595 52601->52213 52602->52215 52604 84120e 52603->52604 52605 8126a4 6 API calls 52604->52605 52606 841219 52605->52606 52607 812688 6 API calls 52606->52607 52608 841220 52607->52608 52609 8126a4 6 API calls 52608->52609 52610 841228 52609->52610 52611 8412d9 52610->52611 52612 841302 52611->52612 52613 8412e9 52611->52613 52612->52595 52617 81269c 6 API calls 52612->52617 52614 8126a4 6 API calls 52613->52614 52615 8412f3 52614->52615 52618 84122e 6 API calls 52615->52618 52617->52597 52618->52612 52620 825e83 __EH_prolog 52619->52620 52621 812ac9 2 API calls 52620->52621 52622 825ed6 52621->52622 52623 812ac9 2 API calls 52622->52623 52624 825ee2 52623->52624 52824 825fed 52624->52824 52636 831d05 52635->52636 52637 831d0c 52635->52637 52638 811c5f 2 API calls 52636->52638 52637->52262 52638->52637 52640 841d60 52639->52640 52641 841df9 52640->52641 52642 8419d3 6 API calls 52640->52642 52641->52262 52644 841d9a 52642->52644 52643 841de3 52643->52641 52846 812579 malloc _CxxThrowException free ctype 52643->52846 52644->52643 52832 811e77 fputc 52644->52832 52647 841dbd fputs 52833 812029 52647->52833 52652 831bea __EH_prolog 52651->52652 52653 812ac9 2 API calls 52652->52653 52654 831c1f 52653->52654 52655 831c3a 2 API calls 52654->52655 52656 831c2b 52655->52656 52656->52262 52658 83227a __EH_prolog 52657->52658 52660 811c5f 2 API calls 52658->52660 52662 8322b3 52658->52662 52659 8322fa 52659->52262 52660->52662 52661 811c5f 2 API calls 52661->52662 52662->52659 52662->52661 52664 842033 __EH_prolog 52663->52664 52665 84204f 52664->52665 52666 848093 6 API calls 52664->52666 52849 8416fc 52665->52849 52666->52665 52668 8422bb 52669 8422c2 52668->52669 52670 8422f3 52668->52670 52671 8422ee 52669->52671 52853 843aa8 52669->52853 52672 842312 52670->52672 52881 811e68 fflush 52670->52881 52671->52262 52672->52671 52673 842320 fputs 52672->52673 52681 842121 fputs 52877 811e77 fputc 52681->52877 52683 81201b 10 API calls 52686 842075 52683->52686 52686->52668 52686->52681 52686->52683 52687 811e8a 10 API calls 52686->52687 52689 841e01 9 API calls 52686->52689 52690 842209 fputs 52686->52690 52697 811e68 fflush 52686->52697 52702 811e77 fputc 52686->52702 52879 841f4c 14 API calls 2 library calls 52686->52879 52687->52686 52689->52686 52878 811e77 fputc 52690->52878 52697->52686 52702->52686 52707 831d9d __EH_prolog 52706->52707 52708 812b9c 2 API calls 52707->52708 52709 831ded 52708->52709 52710 812b9c 2 API calls 52709->52710 52714 831e02 52710->52714 52711 831e41 53008 832406 52711->53008 52714->52711 52716 812c6c 3 API calls 52714->52716 52716->52711 52795 831c96 __EH_prolog 52794->52795 53279 838f7d 52795->53279 52798 831ce2 free 52799 831cb5 52798->52799 53283 811c86 free 52799->53283 52801 831cbd 52802 83ed1c ctype free 52801->52802 52806->52235 52807->52235 52808->52262 52809->52258 52810->52265 52811->52258 52812->52271 52813->52258 52814->52293 52815->52258 52816->52286 52817->52258 52818->52297 52819->52258 52820->52250 52821->52253 52822->52249 52823->52253 52825 825ff7 __EH_prolog 52824->52825 52826 812ac9 2 API calls 52825->52826 52827 826004 52826->52827 52832->52647 52834 812033 __EH_prolog 52833->52834 52835 812b0c 2 API calls 52834->52835 52836 812044 52835->52836 52846->52641 52850 841712 52849->52850 52851 841708 52849->52851 52850->52686 52852 848093 6 API calls 52851->52852 52852->52850 52877->52686 52878->52686 52879->52686 52881->52672 53009 832410 __EH_prolog 53008->53009 53280 838f88 53279->53280 53281 831ca9 53280->53281 53285 839e00 53280->53285 53281->52798 53283->52801 53286 839e11 53285->53286 53287 839e1e 53285->53287 53288 83230d free 53286->53288 53287->53280 53289 839e18 53288->53289 53291 811c86 free 53289->53291 53291->53287 53296 85fb76 53297 85fb7d 53296->53297 53299 85fb7a 53296->53299 53298 85fb81 malloc 53297->53298 53297->53299 53298->53299 53300 81a235 53301 81a242 53300->53301 53303 81a253 53300->53303 53301->53303 53304 811c86 free 53301->53304 53304->53303 53305 839679 53329 8397c4 53305->53329 53308 812ac9 2 API calls 53309 8396af 53308->53309 53310 812ac9 2 API calls 53309->53310 53311 8396bb 53310->53311 53314 8396ec 53311->53314 53337 8158d6 53311->53337 53316 839719 53314->53316 53317 83973d 53314->53317 53358 811c86 free 53316->53358 53319 839791 53317->53319 53324 812a6e 2 API calls 53317->53324 53327 81150c 4 API calls 53317->53327 53360 811c86 free 53317->53360 53361 811c86 free 53319->53361 53320 839721 53359 811c86 free 53320->53359 53323 839799 53362 811c86 free 53323->53362 53324->53317 53326 839729 53327->53317 53330 8397ce __EH_prolog 53329->53330 53331 812ac9 2 API calls 53330->53331 53332 839802 53331->53332 53333 812ac9 2 API calls 53332->53333 53334 839818 53333->53334 53335 812ac9 2 API calls 53334->53335 53336 839680 53335->53336 53336->53308 53338 81586b 6 API calls 53337->53338 53339 8158e2 53338->53339 53340 8158f0 53339->53340 53341 812c08 3 API calls 53339->53341 53342 812c08 3 API calls 53340->53342 53341->53340 53343 815909 53342->53343 53344 839951 53343->53344 53345 83995b __EH_prolog 53344->53345 53346 812c6c 3 API calls 53345->53346 53347 839970 53346->53347 53348 812a6e 2 API calls 53347->53348 53349 83997d 53348->53349 53350 8160c0 36 API calls 53349->53350 53351 83998c 53350->53351 53363 811c86 free 53351->53363 53353 8399a0 53354 8399a5 _CxxThrowException 53353->53354 53355 8399ba 53353->53355 53354->53355 53356 833bfc free 53355->53356 53357 8399c2 53356->53357 53357->53314 53358->53320 53359->53326 53360->53317 53361->53323 53362->53326 53363->53353 53364 84a479 53365 84a486 53364->53365 53366 84a497 53364->53366 53365->53366 53370 84a4bf 53365->53370 53371 84a4c9 __EH_prolog 53370->53371 53379 84a977 53371->53379 53375 84a4eb 53387 821194 free ctype 53375->53387 53377 84a491 53378 811c86 free 53377->53378 53378->53366 53380 84a981 __EH_prolog 53379->53380 53384 84a9b1 53380->53384 53388 84a9c8 53380->53388 53404 811c86 free 53380->53404 53382 84a4df 53386 84a926 free CloseHandle GetLastError __EH_prolog ctype 53382->53386 53405 811c86 free 53384->53405 53386->53375 53387->53377 53389 84a9d2 __EH_prolog 53388->53389 53406 81c738 53389->53406 53394 822b1d free 53395 84aa03 53394->53395 53420 811c86 free 53395->53420 53397 84aa0b 53421 811c86 free 53397->53421 53399 84aa13 53422 84aa41 53399->53422 53404->53380 53405->53382 53407 81c748 53406->53407 53408 81c74d 53406->53408 53438 86e980 SetEvent GetLastError 53407->53438 53410 81c763 53408->53410 53439 86e930 WaitForSingleObject 53408->53439 53414 822bcb 53410->53414 53412 81c75c 53440 86e900 53412->53440 53415 822bd5 __EH_prolog 53414->53415 53418 822c0a 53415->53418 53447 811c86 free 53415->53447 53417 822c12 53417->53394 53446 811c86 free 53418->53446 53420->53397 53421->53399 53423 84aa4b __EH_prolog 53422->53423 53424 81c738 5 API calls 53423->53424 53425 84aa64 53424->53425 53426 86e900 2 API calls 53425->53426 53427 84aa6c 53426->53427 53428 86e900 2 API calls 53427->53428 53429 84aa74 53428->53429 53430 86e900 2 API calls 53429->53430 53431 84aa20 53430->53431 53432 8229f8 53431->53432 53433 822a02 __EH_prolog 53432->53433 53448 811c86 free 53433->53448 53435 822a15 53449 811c86 free 53435->53449 53437 822a1d 53437->53380 53438->53408 53439->53412 53441 86e92b 53440->53441 53442 86e909 CloseHandle 53440->53442 53441->53410 53443 86e914 GetLastError 53442->53443 53444 86e925 53442->53444 53443->53441 53445 86e91e 53443->53445 53444->53441 53445->53410 53446->53417 53447->53415 53448->53435 53449->53437

                                                Executed Functions

                                                Function 00818252 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1724 818252-818277 GetCurrentProcess OpenProcessToken 1725 818279-818289 LookupPrivilegeValueW 1724->1725 1726 8182cf 1724->1726 1728 8182c1 1725->1728 1729 81828b-8182af AdjustTokenPrivileges 1725->1729 1727 8182d2-8182d7 1726->1727 1730 8182c4-8182cd FindCloseChangeNotification 1728->1730 1729->1728 1731 8182b1-8182bf GetLastError 1729->1731 1730->1727 1731->1730
                                                APIs
                                                • GetCurrentProcess.KERNEL32(00000020,00823ECE,?,00000000,?,?,?,?,00823ECE,00823D99), ref: 00818268
                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00823ECE,00823D99), ref: 0081826F
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeRestorePrivilege,?), ref: 00818281
                                                • AdjustTokenPrivileges.ADVAPI32(00823ECE,00000000,?,00000000,00000000,00000000), ref: 008182A7
                                                • GetLastError.KERNEL32 ref: 008182B1
                                                • FindCloseChangeNotification.KERNELBASE(00823ECE,?,?,?,?,00823ECE,00823D99), ref: 008182C7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ProcessToken$AdjustChangeCloseCurrentErrorFindLastLookupNotificationOpenPrivilegePrivilegesValue
                                                • String ID: SeRestorePrivilege
                                                • API String ID: 2838110999-1684392131
                                                • Opcode ID: 99528a0eb18e6d7fead5e46530d03ff2c4355347279398b16d1939454675f2c3
                                                • Instruction ID: 0a09c7a7bbe3784062738fcd3b0e58a8fdaa6367dda7f36e5efbb4caeb25d0ae
                                                • Opcode Fuzzy Hash: 99528a0eb18e6d7fead5e46530d03ff2c4355347279398b16d1939454675f2c3
                                                • Instruction Fuzzy Hash: 50016D75A45618EBCB115BE19C8EBEF7F7CFF06204F040168A545E2150DB748688CBA0
                                                Function 00825A91 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1732 825a91-825ac7 call 874f50 GetCurrentProcess call 825b2f OpenProcessToken 1737 825ac9-825ae9 LookupPrivilegeValueW 1732->1737 1738 825b0e-825b29 call 825b2f 1732->1738 1737->1738 1740 825aeb-825afe AdjustTokenPrivileges 1737->1740 1740->1738 1742 825b00-825b0c GetLastError 1740->1742 1742->1738
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00825A96
                                                • GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,76778E30), ref: 00825AA8
                                                • OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,76778E30), ref: 00825ABF
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00825AE1
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,76778E30), ref: 00825AF6
                                                • GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,76778E30), ref: 00825B00
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ProcessToken$AdjustCurrentErrorH_prologLastLookupOpenPrivilegePrivilegesValue
                                                • String ID: SeSecurityPrivilege
                                                • API String ID: 3475889169-2333288578
                                                • Opcode ID: 6b04a632d07298b92ce7f6dbfd5b67296f70dd285d4e6b863d7359c9b649826d
                                                • Instruction ID: 82a3e78b3f3180af252eb9074d245cc0ac71f3970d88d79d48df245892b1d24d
                                                • Opcode Fuzzy Hash: 6b04a632d07298b92ce7f6dbfd5b67296f70dd285d4e6b863d7359c9b649826d
                                                • Instruction Fuzzy Hash: FF115EB5940629EFDB10DFA4DC89AFEB7BCFB04354F004529E426E2194D734C984CB61
                                                Function 0084987F Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 999COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00849884
                                                  • Part of subcall function 00850F48: _CxxThrowException.MSVCRT(?,00882800), ref: 00850F91
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionH_prologThrow
                                                • String ID:
                                                • API String ID: 461045715-3916222277
                                                • Opcode ID: 9bdb0d454588f3666fcd0101e434cebea2d112dbf14fcac6dfafd960cc19a7b1
                                                • Instruction ID: 21a1dc81377ec0d4e8f21d839dea2891f8d6c6476528cbcb0d4cab687c892e81
                                                • Opcode Fuzzy Hash: 9bdb0d454588f3666fcd0101e434cebea2d112dbf14fcac6dfafd960cc19a7b1
                                                • Instruction Fuzzy Hash: E5926A3090025DDFDB29CFA8C884BAEBBB5FF48314F144098E855EB291DB75AD45CB62
                                                Function 00815C8D Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00815C92
                                                  • Part of subcall function 00815C6D: FindClose.KERNELBASE(00000000,?,00815CA5), ref: 00815C78
                                                • FindFirstFileW.KERNELBASE(?,?,00000001,00000000), ref: 00815CCA
                                                • FindFirstFileW.KERNELBASE(?,?,00000000,00000001,00000000), ref: 00815D03
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Find$FileFirst$CloseH_prolog
                                                • String ID:
                                                • API String ID: 3371352514-0
                                                • Opcode ID: 6f8737fa217c54ef2d03fb0c2cfedf07712d9cd3381857090ffec87feb90843b
                                                • Instruction ID: 2e31d700b470c1d75f35d9ee49407c4989bfefece09e25ab6954a90dd5942dd5
                                                • Opcode Fuzzy Hash: 6f8737fa217c54ef2d03fb0c2cfedf07712d9cd3381857090ffec87feb90843b
                                                • Instruction Fuzzy Hash: AB11BE3140060ADECB20EF68D8895FDB77CFF80320F204268E961D7291CB358AC6CB90
                                                Function 008459DB Relevance: 60.2, APIs: 15, Strings: 19, Instructions: 676COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 0 8459db-8459e2 1 845d3c-845f03 call 81150c * 2 call 811c5f 0->1 2 8459e8-8459f5 call 823bb9 0->2 45 845f05-845f0e call 846a99 1->45 46 845f10 1->46 8 845c02-845c09 2->8 9 8459fb-845a02 2->9 13 845c0f-845c21 call 846e8f 8->13 14 845d29-845d37 call 846f30 8->14 11 845a04-845a0a 9->11 12 845a1c-845a51 call 844da5 9->12 11->12 17 845a0c-845a17 call 812d6a 11->17 28 845a61 12->28 29 845a53-845a59 12->29 25 845c23-845c27 13->25 26 845c2d-845cbd call 833bfc call 8124f8 call 832d7a call 846730 call 8125d6 13->26 30 8465c6-8465cd 14->30 17->12 25->26 87 845cc5-845d24 call 847075 call 83ed1c call 811c86 * 2 call 846efd 26->87 88 845cbf 26->88 36 845a65-845aa6 call 812c6c call 846cf8 28->36 29->28 35 845a5b-845a5f 29->35 31 8465dd-846609 call 847337 call 811c86 call 84c553 30->31 32 8465cf-8465d6 30->32 72 846611-84664c call 8111bb call 847772 call 83ed1c 31->72 73 84660b-84660d 31->73 32->31 37 8465d8 32->37 35->36 62 845ab2-845ac2 36->62 63 845aa8-845aac 36->63 42 8465d8 call 847352 37->42 42->31 51 845f12-845f1b 45->51 46->51 56 845f23-845f80 call 812c6c call 846c18 51->56 57 845f1d-845f1f 51->57 79 845f82-845f86 56->79 80 845f8c-846011 call 8466bb call 84788b call 825724 call 812ac9 call 833309 56->80 57->56 65 845ac4-845aca 62->65 66 845ad5 62->66 63->62 65->66 70 845acc-845ad3 65->70 71 845adc-845b66 call 812c6c call 833bfc call 846730 66->71 70->71 104 845b6a call 83ba1c 71->104 73->72 79->80 125 846035-84607b call 83125a 80->125 126 846013-846030 call 8327aa call 847337 80->126 87->30 88->87 107 845b6f-845b79 104->107 110 845b88-845b91 107->110 111 845b7b-845b83 call 848093 107->111 112 845b93 110->112 113 845b99-845bfd call 847075 call 83ed1c call 811c86 call 8478d1 call 811c86 call 847ffa 110->113 111->110 112->113 113->30 131 846080-846089 125->131 126->125 134 846095-846098 131->134 135 84608b-846090 call 848093 131->135 139 8460e1-8460ed 134->139 140 84609a-8460a1 134->140 135->134 141 846151-84615d 139->141 142 8460ef-8460fd call 811e77 139->142 144 8460d5-8460d8 140->144 145 8460a3-8460d0 call 811e77 fputs call 811e77 call 811e8a call 811e77 140->145 146 84618c-846198 141->146 147 84615f-846165 141->147 159 8460ff-846106 142->159 160 846108-84614c fputs call 812110 call 811e77 fputs call 812110 call 811e77 142->160 144->139 148 8460da 144->148 145->144 154 84619a-8461a0 146->154 155 8461cb-8461cd 146->155 147->146 152 846167-846187 fputs call 812110 call 811e77 147->152 148->139 152->146 161 8461a6-8461c6 fputs call 812110 call 811e77 154->161 162 84624c-846258 154->162 155->162 165 8461cf-8461de 155->165 159->141 159->160 160->141 161->155 169 84629c-8462a0 162->169 170 84625a-846260 162->170 173 846204-846210 165->173 174 8461e0-8461ff fputs call 812110 call 811e77 165->174 177 8462a2 169->177 178 8462a9-8462ab 169->178 170->177 182 846262-846275 call 811e77 170->182 173->162 176 846212-846225 call 811e77 173->176 174->173 176->162 202 846227-846247 fputs call 812110 call 811e77 176->202 177->178 187 8462b1-8462bd 178->187 188 84646b-8464a4 call 833384 call 811c86 call 8479f8 call 811c86 178->188 182->177 201 846277-846297 fputs call 812110 call 811e77 182->201 196 8462c3-8462d2 187->196 197 84642f-846445 call 811e77 187->197 242 8465ae-8465c1 call 83ed1c * 2 188->242 243 8464aa-8464b0 188->243 196->197 204 8462d8-8462dc 196->204 197->188 213 846447-846466 fputs call 812110 call 811e77 197->213 201->169 202->162 204->188 210 8462e2-8462f0 204->210 217 8462f2-84630b fputs call 812110 210->217 218 84631d-846324 210->218 213->188 230 846310-846317 call 811e77 217->230 219 846345-84635e fputs call 812110 218->219 220 846326-84632d 218->220 233 846363-846376 call 811e77 219->233 220->219 226 84632f-846335 220->226 226->219 231 846337-846343 226->231 230->218 231->219 236 8463c2-8463db fputs call 812110 231->236 233->236 245 846378-8463bd fputs call 812110 call 811e77 fputs call 812110 call 811e77 233->245 244 8463e0-8463e5 call 811e77 236->244 242->30 243->242 251 8463ea-846407 fputs call 812110 244->251 245->236 256 84640c-846417 call 811e77 251->256 256->188 263 846419-84642d call 811e77 call 842c7e 256->263 263->188
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$ExceptionThrow
                                                • String ID: F{v$7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings: $S_$u
                                                • API String ID: 3665150552-573022172
                                                • Opcode ID: ccdefcb1d253d332b4270d9b6244adc2c1ed536854acd162ccb1e9e18db9c5c6
                                                • Instruction ID: 9f9d4ebfdefd8d3f83c2b63d4e36bc3293d380052b1ba468feafb1d79e731dee
                                                • Opcode Fuzzy Hash: ccdefcb1d253d332b4270d9b6244adc2c1ed536854acd162ccb1e9e18db9c5c6
                                                • Instruction Fuzzy Hash: 2F526A3090065C9FDF25DBA8C899BEDBBB5FF45300F14419AE449E7292EB706A84CF52
                                                Function 00845DE8 Relevance: 58.2, APIs: 15, Strings: 18, Instructions: 494COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 268 845de8-845def 269 845e05-845e9e call 8410af call 812ac9 call 830a6a call 811c86 268->269 270 845df1-845e00 fputs call 811e77 268->270 280 845ea0-845ea8 call 848093 269->280 281 845ead-845eb0 269->281 270->269 280->281 283 845eb2-845eb9 281->283 284 845ecd-845edf call 847ffa 281->284 283->284 285 845ebb-845ec8 call 84145c 283->285 289 845ee5-845f03 call 811c5f 284->289 290 8465ae-8465cd call 83ed1c * 2 284->290 285->284 298 845f05-845f0e call 846a99 289->298 299 845f10 289->299 300 8465dd-846609 call 847337 call 811c86 call 84c553 290->300 301 8465cf-8465d6 290->301 303 845f12-845f1b 298->303 299->303 322 846611-84664c call 8111bb call 847772 call 83ed1c 300->322 323 84660b-84660d 300->323 301->300 304 8465d8 call 847352 301->304 307 845f23-845f80 call 812c6c call 846c18 303->307 308 845f1d-845f1f 303->308 304->300 318 845f82-845f86 307->318 319 845f8c-846011 call 8466bb call 84788b call 825724 call 812ac9 call 833309 307->319 308->307 318->319 340 846035-846089 call 83125a 319->340 341 846013-846030 call 8327aa call 847337 319->341 323->322 347 846095-846098 340->347 348 84608b-846090 call 848093 340->348 341->340 350 8460e1-8460ed 347->350 351 84609a-8460a1 347->351 348->347 352 846151-84615d 350->352 353 8460ef-8460fd call 811e77 350->353 354 8460d5-8460d8 351->354 355 8460a3-8460d0 call 811e77 fputs call 811e77 call 811e8a call 811e77 351->355 356 84618c-846198 352->356 357 84615f-846165 352->357 367 8460ff-846106 353->367 368 846108-84614c fputs call 812110 call 811e77 fputs call 812110 call 811e77 353->368 354->350 358 8460da 354->358 355->354 363 84619a-8461a0 356->363 364 8461cb-8461cd 356->364 357->356 361 846167-846187 fputs call 812110 call 811e77 357->361 358->350 361->356 369 8461a6-8461c6 fputs call 812110 call 811e77 363->369 370 84624c-846258 363->370 364->370 372 8461cf-8461de 364->372 367->352 367->368 368->352 369->364 376 84629c-8462a0 370->376 377 84625a-846260 370->377 379 846204-846210 372->379 380 8461e0-8461ff fputs call 812110 call 811e77 372->380 383 8462a2 376->383 384 8462a9-8462ab 376->384 377->383 388 846262-846275 call 811e77 377->388 379->370 382 846212-846225 call 811e77 379->382 380->379 382->370 408 846227-846247 fputs call 812110 call 811e77 382->408 383->384 393 8462b1-8462bd 384->393 394 84646b-8464a4 call 833384 call 811c86 call 8479f8 call 811c86 384->394 388->383 407 846277-846297 fputs call 812110 call 811e77 388->407 402 8462c3-8462d2 393->402 403 84642f-846445 call 811e77 393->403 394->290 448 8464aa-8464b0 394->448 402->403 410 8462d8-8462dc 402->410 403->394 419 846447-846466 fputs call 812110 call 811e77 403->419 407->376 408->370 410->394 416 8462e2-8462f0 410->416 423 8462f2-84630b fputs call 812110 416->423 424 84631d-846324 416->424 419->394 436 846310-846317 call 811e77 423->436 425 846345-84635e fputs call 812110 424->425 426 846326-84632d 424->426 439 846363-846376 call 811e77 425->439 426->425 432 84632f-846335 426->432 432->425 437 846337-846343 432->437 436->424 437->425 442 8463c2-846407 fputs call 812110 call 811e77 fputs call 812110 437->442 439->442 450 846378-8463bd fputs call 812110 call 811e77 fputs call 812110 call 811e77 439->450 458 84640c-846417 call 811e77 442->458 448->290 450->442 458->394 465 846419-84642d call 811e77 call 842c7e 458->465 465->394
                                                APIs
                                                • fputs.MSVCRT(Scanning the drive for archives:), ref: 00845DFA
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputcfputs
                                                • String ID: F{v$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings: $S_$u
                                                • API String ID: 269475090-3387436929
                                                • Opcode ID: 21731a0e1f3fef0a7fc64bf3a4749f25ab48dd51586d64bc65ecc64b86c20065
                                                • Instruction ID: e7f519b2abda046073ac39c78070275c045ddf2ecacc90a786bc890e166e785e
                                                • Opcode Fuzzy Hash: 21731a0e1f3fef0a7fc64bf3a4749f25ab48dd51586d64bc65ecc64b86c20065
                                                • Instruction Fuzzy Hash: 12227B30A002589FDF25EBA8C849BEDFBB5FF45300F14459AE449A3291EB706E94CF52
                                                Function 008453C3 Relevance: 44.3, APIs: 15, Strings: 10, Instructions: 504COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 470 8453c3-8453eb call 846f82 call 823f15 475 8453ed-8453f9 470->475 476 8453fb 470->476 475->476 477 8453fe-845408 475->477 476->477 478 845428-845457 call 811c5f call 84664d 477->478 479 84540a-84541f GetStdHandle GetConsoleScreenBufferInfo 477->479 487 84545f-845496 call 83379b call 847337 call 823b95 478->487 488 845459-84545b 478->488 479->478 480 845421-845425 479->480 480->478 495 8454cc-8454f5 call 839cc1 487->495 496 845498-84549c 487->496 488->487 502 8454f7-845508 _CxxThrowException 495->502 503 84550d-84552b 495->503 498 8454b6-8454c7 _CxxThrowException 496->498 499 84549e-8454a5 496->499 498->495 499->498 501 8454a7-8454b4 call 823bb9 499->501 501->495 501->498 502->503 505 845587-8455a3 503->505 506 84552d-845551 call 833a87 503->506 510 8455a5 505->510 511 8455aa-8455e4 call 811e77 fputs call 811e77 strlen 505->511 514 845557-84555b 506->514 515 84563a-84564b _CxxThrowException 506->515 510->511 524 8455ea-845624 fputs fputc 511->524 525 84580b-845833 call 811e77 fputs call 811e77 511->525 514->515 517 845561-845585 call 84796b call 811c86 514->517 518 845650 515->518 517->505 517->506 521 845652-845665 518->521 528 845626-845630 521->528 529 845667-845697 call 847047 call 812ac9 521->529 524->528 524->529 539 8458dc-845904 call 811e77 fputs call 811e77 525->539 540 845839 525->540 528->518 532 845632-845638 528->532 554 8456f6-84570e call 847047 529->554 555 845699-84569d 529->555 532->521 556 8465c6-8465cd 539->556 557 84590a 539->557 541 845840-845855 call 84701a 540->541 549 845857-84585f 541->549 550 845861-845864 call 8120e7 541->550 562 845869-8458d6 call 84774a fputs call 811e77 549->562 550->562 583 845710-845730 fputs call 8120e7 554->583 584 845731-845739 554->584 563 8456a7-8456c3 call 812e51 555->563 564 84569f-8456a2 call 812dd6 555->564 558 8465dd-846609 call 847337 call 811c86 call 84c553 556->558 559 8465cf-8465d6 556->559 565 845911-84596d call 84701a call 846fb3 call 84774a fputs call 811e77 557->565 606 846611-84664c call 8111bb call 847772 call 83ed1c 558->606 607 84660b-84660d 558->607 559->558 566 8465d8 call 847352 559->566 562->539 562->541 579 8456c5-8456e6 call 812e8d call 812e51 call 811089 563->579 580 8456eb-8456f4 563->580 564->563 637 84596f 565->637 566->558 579->580 580->554 580->555 583->584 588 8457e5-845805 call 811e77 call 811c86 584->588 589 84573f-845743 584->589 588->524 588->525 593 845754-845768 589->593 594 845745-845753 fputs 589->594 603 8457d6-8457df 593->603 604 84576a-84576e 593->604 594->593 603->588 603->589 612 845770-84577a 604->612 613 84577b-845785 604->613 607->606 612->613 617 845787-845789 613->617 618 84578b-845797 613->618 617->618 625 8457be-8457d4 617->625 626 84579e 618->626 627 845799-84579c 618->627 625->603 625->604 631 8457a1-8457b4 626->631 627->631 640 8457b6-8457b9 631->640 641 8457bb 631->641 637->556 640->625 641->625
                                                APIs
                                                  • Part of subcall function 00846F82: fputs.MSVCRT ref: 00846F9B
                                                  • Part of subcall function 00846F82: fputs.MSVCRT ref: 00846FAB
                                                  • Part of subcall function 00823F15: _CxxThrowException.MSVCRT(?,00884638), ref: 00823F49
                                                  • Part of subcall function 00823F15: _CxxThrowException.MSVCRT(?,00884638), ref: 00823F80
                                                  • Part of subcall function 00823F15: wcscmp.MSVCRT ref: 00823FEE
                                                • GetStdHandle.KERNEL32(000000F5,?,?,?,?,?,?,?), ref: 00845410
                                                • GetConsoleScreenBufferInfo.KERNELBASE(00000000,?,?,?,?,?,?), ref: 00845417
                                                • _CxxThrowException.MSVCRT(?,008831D8), ref: 008454C7
                                                • _CxxThrowException.MSVCRT(?,008831D8), ref: 00845508
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$fputs$BufferConsoleHandleInfoScreenwcscmp
                                                • String ID: || $ F{v$Codecs:$Formats:$Hashers:$KSNFMGOPBELH$P$offset=$S_$u
                                                • API String ID: 3991676522-2410024224
                                                • Opcode ID: 11812866a8303f46c9f77eaa412cd1bd8a7918e54d3e1c542794443bbe0f3659
                                                • Instruction ID: dbe3c755fe406257871de207d250b0e43ccdc77e1fc50aca1eec9758dab29134
                                                • Opcode Fuzzy Hash: 11812866a8303f46c9f77eaa412cd1bd8a7918e54d3e1c542794443bbe0f3659
                                                • Instruction Fuzzy Hash: 7F127E71900218DFDF15EFA8D889BADBBB5FF08310F10405AE545EB292DB749A85CF62
                                                Function 00823BCF Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 230COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 642 823bcf-823bf2 call 874f50 call 8113e5 647 823c10-823c6d _fileno _isatty _fileno _isatty _fileno _isatty 642->647 648 823bf4-823c0b call 830f43 _CxxThrowException 642->648 650 823c6f-823c72 647->650 651 823c7d-823c7f 647->651 648->647 650->651 653 823c74-823c77 650->653 654 823c80-823cbb 651->654 653->651 657 823c79-823c7b 653->657 655 823cc7 654->655 656 823cbd-823cc0 654->656 659 823ccd-823cd0 655->659 656->655 658 823cc2-823cc5 656->658 657->654 658->655 658->659 660 823cd2 659->660 661 823cd8-823ce1 659->661 660->661 662 823ce3-823ce6 661->662 663 823cec-823cf5 661->663 662->663 664 823d00-823d09 663->664 665 823cf7-823cfa 663->665 666 823d14-823d19 664->666 667 823d0b-823d0e 664->667 665->664 668 823d70-823d78 666->668 669 823d1b-823d29 666->669 667->666 670 823d94 call 823ec2 668->670 671 823d7a-823d91 668->671 672 823d37-823d45 call 823eda 669->672 673 823d2b-823d35 669->673 677 823d99-823da1 670->677 671->670 678 823d67-823d6a 672->678 679 823d47-823d62 call 830f43 _CxxThrowException 672->679 673->668 680 823da3-823db1 677->680 681 823dde-823de6 677->681 678->668 679->678 685 823e53-823e65 wcscmp 680->685 686 823db7 680->686 683 823eb1-823ebf 681->683 684 823dec-823df7 681->684 684->683 690 823dfd-823e15 call 8124f8 call 812627 684->690 688 823e6b-823e77 call 823eda 685->688 689 823dbe-823dc6 call 8182d8 685->689 686->689 688->689 697 823e7d-823e95 call 830f43 _CxxThrowException 688->697 689->681 699 823dc8-823dd9 call 85fa70 call 818252 689->699 705 823e36-823e4e call 830f43 _CxxThrowException 690->705 706 823e17-823e27 call 81360f 690->706 709 823e9a-823eb0 GetCurrentProcess SetProcessAffinityMask call 811c86 697->709 699->681 705->685 716 823e31-823e34 706->716 717 823e29-823e2f 706->717 709->683 716->705 716->709 717->716
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00823BD4
                                                  • Part of subcall function 008113E5: __EH_prolog.LIBCMT ref: 008113EA
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00823C0B
                                                • _fileno.MSVCRT ref: 00823C1C
                                                • _isatty.MSVCRT ref: 00823C1F
                                                • _fileno.MSVCRT ref: 00823C39
                                                • _isatty.MSVCRT ref: 00823C3C
                                                • _fileno.MSVCRT ref: 00823C53
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00823D62
                                                • _isatty.MSVCRT ref: 00823C56
                                                  • Part of subcall function 00830F43: __EH_prolog.LIBCMT ref: 00830F48
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00823E4E
                                                • wcscmp.MSVCRT ref: 00823E5B
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00823E95
                                                • GetCurrentProcess.KERNEL32(00000000,?), ref: 00823E9B
                                                • SetProcessAffinityMask.KERNEL32(00000000), ref: 00823EA2
                                                Strings
                                                • @4wv, xrefs: 00823C16
                                                • SeLockMemoryPrivilege, xrefs: 00823DCF
                                                • Unsupported switch postfix for -slp, xrefs: 00823E82
                                                • Unsupported switch postfix -bb, xrefs: 00823D4F
                                                • Unsupported switch postfix -stm, xrefs: 00823E3B
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prolog_fileno_isatty$Process$AffinityCurrentMaskwcscmp
                                                • String ID: @4wv$SeLockMemoryPrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
                                                • API String ID: 3459974080-2282373866
                                                • Opcode ID: c18d8cf2d0e28fa4e0728024aa4491bda10efc3dca910376d35d49c0904adf17
                                                • Instruction ID: 5bb9b61f3d6d4590060e251511b1293197e8067c9f035ae28f7a0d1eeff15292
                                                • Opcode Fuzzy Hash: c18d8cf2d0e28fa4e0728024aa4491bda10efc3dca910376d35d49c0904adf17
                                                • Instruction Fuzzy Hash: B691B071501385AFDB21EF78D4A4A99BFB4FF15300F0484A9E499DB362D734EA88CB61
                                                Function 00843AA8 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 240COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 718 843aa8-843ac8 call 874f50 721 843ace-843b02 fputs call 843de6 718->721 722 843d2a 718->722 726 843b04-843b0a 721->726 727 843b61-843b69 721->727 724 843d2c-843d3a 722->724 730 843b24-843b26 726->730 731 843b0c-843b22 fputs call 811e77 726->731 728 843b72-843b7b 727->728 729 843b6b-843b70 727->729 732 843b7e-843bb2 call 843de6 call 8440c7 728->732 729->732 734 843b2f-843b38 730->734 735 843b28-843b2d 730->735 731->727 745 843bb4-843bbb call 843dc4 732->745 746 843bc0-843bd1 call 84400a 732->746 738 843b3b-843b60 call 812b0c call 84406b call 811c86 734->738 735->738 738->727 745->746 746->724 753 843bd7-843be1 746->753 754 843be3-843bea call 843d60 753->754 755 843bef-843bfd 753->755 754->755 755->724 758 843c03-843c06 755->758 759 843c58-843c62 758->759 760 843c08-843c28 758->760 761 843c68-843c83 fputs 759->761 762 843d1b-843d24 759->762 764 843d3d-843d42 760->764 765 843c2e-843c38 call 84400a 760->765 761->762 767 843c89-843ca0 761->767 762->721 762->722 768 843d56-843d5e SysFreeString 764->768 772 843c3d-843c3f 765->772 770 843ca2-843cc4 767->770 771 843d18 767->771 768->724 775 843d44-843d46 770->775 776 843cc6-843cea 770->776 771->762 772->764 773 843c45-843c56 SysFreeString 772->773 773->759 773->760 777 843d53 775->777 779 843cec-843d16 call 843f4c call 818570 SysFreeString 776->779 780 843d48-843d50 call 818570 776->780 777->768 779->770 779->771 780->777
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00843AAD
                                                • fputs.MSVCRT ref: 00843AE3
                                                  • Part of subcall function 00843DE6: __EH_prolog.LIBCMT ref: 00843DEB
                                                  • Part of subcall function 00843DE6: fputs.MSVCRT ref: 00843E00
                                                  • Part of subcall function 00843DE6: fputs.MSVCRT ref: 00843E09
                                                • fputs.MSVCRT ref: 00843B13
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                • SysFreeString.OLEAUT32(00000000), ref: 00843C4C
                                                • fputs.MSVCRT ref: 00843C6F
                                                • SysFreeString.OLEAUT32(00000000), ref: 00843D0C
                                                • SysFreeString.OLEAUT32(00000000), ref: 00843D56
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$FreeString$H_prolog$fputc
                                                • String ID: --$----$Path$Type$Warning: The archive is open with offset
                                                • API String ID: 2047134881-3797937567
                                                • Opcode ID: 7f167415d328ab3d5c38ca8bfed8ba6d3144027f1dc88e9ca170a708dd89dc53
                                                • Instruction ID: ccbf6d13724cbb75664128560cd4dce2409c61b743e708f41197f983b3400c42
                                                • Opcode Fuzzy Hash: 7f167415d328ab3d5c38ca8bfed8ba6d3144027f1dc88e9ca170a708dd89dc53
                                                • Instruction Fuzzy Hash: B5915631A00209EFDB15DFA8C995FAEB7B5FF48324F204129E516E7291DB30AE45CB61
                                                Function 00826B08 Relevance: 15.7, APIs: 2, Strings: 6, Instructions: 1665COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00826B0D
                                                  • Part of subcall function 008139DE: __EH_prolog.LIBCMT ref: 008139E3
                                                  • Part of subcall function 008139C5: wcscmp.MSVCRT ref: 008139D0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$wcscmp
                                                • String ID: $Can not seek to begin of file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
                                                • API String ID: 3232955128-2809321072
                                                • Opcode ID: 56ab14549137cbcc168e447d920fe908df3d6468614b4b84250eeba2953204b6
                                                • Instruction ID: cf806c2f7f43c91265d3dd438adee93aabfc10cb57680fd0a165311610220bed
                                                • Opcode Fuzzy Hash: 56ab14549137cbcc168e447d920fe908df3d6468614b4b84250eeba2953204b6
                                                • Instruction Fuzzy Hash: C9E29B71904269DFCF21EFA8E894AEDBBB5FF04300F144469E086E7251DB3169C9DB62
                                                Function 00842029 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1543 842029-842043 call 874f50 1546 842045-842055 call 848093 1543->1546 1547 84206e-84207e call 8416fc 1543->1547 1546->1547 1552 842057-84206b 1546->1552 1553 842084-84209c 1547->1553 1554 8422bd-8422c0 1547->1554 1552->1547 1557 8420a1-8420a3 1553->1557 1558 84209e 1553->1558 1555 8422c2-8422ca 1554->1555 1556 8422f3-84230b 1554->1556 1559 8422d0-8422d6 call 843aa8 1555->1559 1560 8423b9 call 841117 1555->1560 1561 842312-84231a 1556->1561 1562 84230d call 811e68 1556->1562 1563 8420a5-8420a8 1557->1563 1564 8420ae-8420b6 1557->1564 1558->1557 1577 8422db-8422dd 1559->1577 1574 8423be-8423cc 1560->1574 1561->1560 1565 842320-84235e fputs call 812029 call 811e77 call 84412a 1561->1565 1562->1561 1563->1564 1571 842180-84218b call 8423cf 1563->1571 1566 8420e0-8420e2 1564->1566 1567 8420b8-8420c1 call 811e77 1564->1567 1565->1574 1628 842360-842366 1565->1628 1575 8420e4-8420ec 1566->1575 1576 842111-842115 1566->1576 1567->1566 1588 8420c3-8420db call 81201b call 811e77 1567->1588 1592 842196-84219e 1571->1592 1593 84218d-842190 1571->1593 1581 8420ee-8420f4 call 841e01 1575->1581 1582 8420f9-84210d 1575->1582 1585 842166-84216e 1576->1585 1586 842117-84211f 1576->1586 1577->1574 1583 8422e3-8422ee call 811e77 1577->1583 1581->1582 1582->1576 1583->1560 1585->1571 1589 842170-84217b call 811e77 call 811e68 1585->1589 1594 842121-842149 fputs call 811e77 call 811e8a call 811e77 1586->1594 1595 84214e-842162 1586->1595 1588->1566 1589->1571 1601 8421a0-8421a9 call 811e77 1592->1601 1602 8421c8-8421ca 1592->1602 1593->1592 1600 842271-842275 1593->1600 1594->1595 1595->1585 1611 842277-842285 1600->1611 1612 8422a9-8422b5 1600->1612 1601->1602 1625 8421ab-8421c3 call 81201b call 811e77 1601->1625 1608 8421cc-8421d4 1602->1608 1609 8421f9-8421fd 1602->1609 1618 8421d6-8421dc call 841e01 1608->1618 1619 8421e1-8421f5 1608->1619 1621 84224e-842256 1609->1621 1622 8421ff-842207 1609->1622 1623 842287-842299 call 841f4c 1611->1623 1624 8422a2 1611->1624 1612->1553 1615 8422bb 1612->1615 1615->1554 1618->1619 1619->1609 1621->1600 1627 842258-842264 call 811e77 1621->1627 1630 842236-84224a 1622->1630 1631 842209-842231 fputs call 811e77 call 811e8a call 811e77 1622->1631 1623->1624 1646 84229b-84229d call 811e68 1623->1646 1624->1612 1625->1602 1627->1600 1650 842266-84226c call 811e68 1627->1650 1636 8423ae-8423b4 call 811e68 1628->1636 1637 842368-84236e 1628->1637 1630->1621 1631->1630 1636->1560 1643 842370-842380 fputs 1637->1643 1644 842382-84239d call 814e4a call 811e8a call 811c86 1637->1644 1651 8423a2-8423a9 call 811e77 1643->1651 1644->1651 1646->1624 1650->1600 1651->1636
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084202E
                                                • fputs.MSVCRT ref: 0084212E
                                                  • Part of subcall function 00848093: fputs.MSVCRT ref: 008480FC
                                                • fputs.MSVCRT ref: 00842216
                                                • fputs.MSVCRT ref: 0084232E
                                                • fputs.MSVCRT ref: 0084237D
                                                  • Part of subcall function 00811E68: fflush.MSVCRT ref: 00811E6A
                                                  • Part of subcall function 00814E4A: __EH_prolog.LIBCMT ref: 00814E4F
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog$fflushfree
                                                • String ID: Can't allocate required memory$ERRORS:$WARNINGS:
                                                • API String ID: 1750297421-1898165966
                                                • Opcode ID: 498172035ad4fa505769529843ea909284eda8f1555f1928d0a02a0346a4288a
                                                • Instruction ID: ba5ff7571ff35b2245ad0a25163000d96a37d378cd8c0edb3f50370bad037f20
                                                • Opcode Fuzzy Hash: 498172035ad4fa505769529843ea909284eda8f1555f1928d0a02a0346a4288a
                                                • Instruction Fuzzy Hash: 93B16030605B09CFEB24EFA4C898BEAB7B1FF44304F54452DE95AD7652CB74A884CB61
                                                Function 00842432 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1661 842432-84245e call 874f50 EnterCriticalSection 1664 842460-842465 call 848093 1661->1664 1665 84247b-842483 1661->1665 1669 84246a-842478 1664->1669 1667 842485 call 811e68 1665->1667 1668 84248a-84248f 1665->1668 1667->1668 1671 842495-8424a1 1668->1671 1672 84255e-842574 1668->1672 1669->1665 1673 8424e3-8424fb 1671->1673 1674 8424a3-8424a9 1671->1674 1675 84260a 1672->1675 1676 84257a-84257d 1672->1676 1678 8424fd-84250e call 811e77 1673->1678 1679 84253f-842547 1673->1679 1674->1673 1681 8424ab-8424b7 1674->1681 1680 84260c-842623 LeaveCriticalSection 1675->1680 1676->1675 1677 842583-84258b 1676->1677 1682 8425fc-842608 call 841117 1677->1682 1683 84258d-8425af call 811e77 fputs 1677->1683 1678->1679 1696 842510-842538 fputs call 812110 1678->1696 1679->1682 1685 84254d-842553 1679->1685 1686 8424bf-8424cd 1681->1686 1687 8424b9 1681->1687 1682->1680 1698 8425c4-8425e0 call 814e4a call 811e8a call 811c86 1683->1698 1699 8425b1-8425c2 fputs 1683->1699 1685->1682 1692 842559 1685->1692 1686->1679 1689 8424cf-8424e1 fputs 1686->1689 1687->1686 1694 84253a call 811e77 1689->1694 1697 8425f7 call 811e68 1692->1697 1694->1679 1696->1694 1697->1682 1703 8425e5-8425f1 call 811e77 1698->1703 1699->1703 1703->1697
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00842437
                                                • EnterCriticalSection.KERNEL32(0088C7F0), ref: 0084244D
                                                • fputs.MSVCRT ref: 008424D7
                                                • LeaveCriticalSection.KERNEL32(0088C7F0), ref: 0084260D
                                                  • Part of subcall function 00848093: fputs.MSVCRT ref: 008480FC
                                                • fputs.MSVCRT ref: 0084251D
                                                  • Part of subcall function 00812110: fputs.MSVCRT ref: 0081212D
                                                • fputs.MSVCRT ref: 008425A2
                                                • fputs.MSVCRT ref: 008425BF
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$CriticalSection$EnterH_prologLeavefputc
                                                • String ID: Sub items Errors:
                                                • API String ID: 2670240366-2637271492
                                                • Opcode ID: 8a3b16652a8b0df2cb149bc358f61d00d43759f8d8273b36eed6871f5fcf5d2b
                                                • Instruction ID: 04bb50849365adfb2de93b62a5bc174a6d6b2e6d80e53ae01c330f6b1af3f99e
                                                • Opcode Fuzzy Hash: 8a3b16652a8b0df2cb149bc358f61d00d43759f8d8273b36eed6871f5fcf5d2b
                                                • Instruction Fuzzy Hash: E651CB31504608CFDB65EF68D894AEAB7E1FF44314F95442EE69AC7661DB31AC80CF11
                                                Function 0081893E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 47libraryloaderCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1712 81893e-818971 GetModuleHandleW GetProcAddress 1713 818973-81897b GlobalMemoryStatusEx 1712->1713 1714 81899e-8189b5 GlobalMemoryStatus 1712->1714 1713->1714 1715 81897d-818986 1713->1715 1716 8189b7 1714->1716 1717 8189ba-8189bc 1714->1717 1718 818994 1715->1718 1719 818988 1715->1719 1716->1717 1720 8189c0-8189c4 1717->1720 1723 818997-81899c 1718->1723 1721 81898a-81898d 1719->1721 1722 81898f-818992 1719->1722 1721->1718 1721->1722 1722->1723 1723->1720
                                                APIs
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 00818962
                                                • GetProcAddress.KERNEL32(00000000), ref: 00818969
                                                • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 00818977
                                                • GlobalMemoryStatus.KERNEL32(?), ref: 008189A9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: GlobalMemoryStatus$AddressHandleModuleProc
                                                • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                • API String ID: 180289352-802862622
                                                • Opcode ID: 0af272a5120eb709127a7fa80ef1d4470bd4b2047ebfaa97a24100112fda8a7a
                                                • Instruction ID: 450c8ec506b0a75228d26ae8f66c8f2277685fc3b9f0fcb6d10e2e76013e42e6
                                                • Opcode Fuzzy Hash: 0af272a5120eb709127a7fa80ef1d4470bd4b2047ebfaa97a24100112fda8a7a
                                                • Instruction Fuzzy Hash: 3111E2B0900209DBDB10DF94C89AAADBBB9FF14305F104418E596E7644DB78A884CB65
                                                Function 008160C0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 350COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1743 8160c0-8160de call 874f50 call 817505 1748 816185-816190 call 817775 1743->1748 1749 8160e4-816104 call 816020 call 812c08 call 817680 1743->1749 1755 816347-81635d call 8176a9 1748->1755 1756 816196-81619c 1748->1756 1768 816106-81610b 1749->1768 1769 81614c-81615f call 816c63 1749->1769 1763 816362-81636f call 817475 1755->1763 1764 81635f-816361 1755->1764 1756->1755 1759 8161a2-8161c5 call 812b0c * 2 1756->1759 1775 8161d2-8161d8 1759->1775 1776 8161c7-8161cd 1759->1776 1777 816371-816377 1763->1777 1778 8163c4-8163cb 1763->1778 1764->1763 1768->1769 1772 81610d-81613a call 818191 1768->1772 1781 816161-816163 1769->1781 1782 816165-816169 1769->1782 1772->1769 1798 81613c-816147 1772->1798 1783 8161da-8161ed call 812299 1775->1783 1784 8161ef-8161f7 call 812e8d 1775->1784 1776->1775 1777->1778 1787 816379-816385 call 816043 1777->1787 1785 8163d7-8163de 1778->1785 1786 8163cd-8163d1 1778->1786 1789 816178-816180 call 816834 1781->1789 1790 816176 1782->1790 1791 81616b-816173 1782->1791 1783->1784 1802 8161fc-816209 call 817680 1783->1802 1784->1802 1794 816410-816417 call 817623 1785->1794 1795 8163e0-8163ea call 816043 1785->1795 1786->1785 1793 8164b5-8164ba call 815c8d 1786->1793 1787->1793 1811 81638b-81638e 1787->1811 1814 8164c9 1789->1814 1790->1789 1791->1790 1810 8164bf 1793->1810 1794->1793 1819 81641d-816428 1794->1819 1795->1793 1815 8163f0-8163f3 1795->1815 1806 816510-816512 1798->1806 1822 816241-81624b call 8160c0 1802->1822 1823 81620b-81620e 1802->1823 1812 8164cb-8164d9 1806->1812 1817 8164c1-8164c4 call 815c6d 1810->1817 1811->1793 1818 816394-8163b1 call 816020 call 812c08 1811->1818 1814->1812 1815->1793 1821 8163f9-81640e call 816020 1815->1821 1817->1814 1841 8163bd-8163bf 1818->1841 1846 8163b3-8163b8 1818->1846 1819->1793 1820 81642e-816435 call 81742d 1819->1820 1820->1793 1838 816437-81646a call 812b0c call 811089 * 2 call 815c8d 1820->1838 1821->1841 1839 816251 1822->1839 1840 816335-816346 call 811c86 * 2 1822->1840 1829 816210-816213 1823->1829 1830 81621c-816234 call 816020 1823->1830 1829->1822 1835 816215-81621a 1829->1835 1844 816253-816279 call 812b9c call 812ac9 1830->1844 1845 816236-81623f call 812c6c 1830->1845 1835->1822 1835->1830 1870 81646c-816482 wcscmp 1838->1870 1871 81648f-81649c call 816043 1838->1871 1839->1844 1840->1755 1841->1817 1861 81627e-816294 call 815fe0 1844->1861 1845->1844 1846->1841 1867 816296-81629a 1861->1867 1868 8162ca-8162cc 1861->1868 1872 8162c2-8162c4 SetLastError 1867->1872 1873 81629c-8162a9 call 81219d 1867->1873 1869 816304-816330 call 811c86 * 2 call 815c6d call 811c86 * 2 1868->1869 1869->1814 1877 816484-816489 1870->1877 1878 81648b 1870->1878 1884 8164dc-8164e6 call 816020 1871->1884 1885 81649e-8164a1 1871->1885 1872->1868 1886 8162ab-8162c0 call 811c86 call 812ac9 1873->1886 1887 8162ce-8162d4 1873->1887 1882 8164fa-81650b call 812c08 call 811c86 call 815c6d 1877->1882 1878->1871 1882->1806 1904 8164e8-8164eb 1884->1904 1905 8164ed 1884->1905 1890 8164a3-8164a6 1885->1890 1891 8164a8-8164b4 call 811c86 1885->1891 1886->1861 1894 8162e7-816302 call 812e51 1887->1894 1895 8162d6-8162db 1887->1895 1890->1884 1890->1891 1891->1793 1894->1869 1895->1894 1902 8162dd-8162e3 1895->1902 1902->1894 1911 8164f4-8164f7 1904->1911 1905->1911 1911->1882
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008160C5
                                                • SetLastError.KERNEL32(00000002,?,00000000,00000001,:$DATA,00000001,00000000,00000001), ref: 008162C4
                                                  • Part of subcall function 00818191: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,771AF5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 008181AD
                                                  • Part of subcall function 00818191: GetProcAddress.KERNEL32(00000000), ref: 008181B4
                                                  • Part of subcall function 00818191: GetDiskFreeSpaceW.KERNEL32(00000001,00816B24,?,?,?,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 00818204
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressDiskErrorFreeH_prologHandleLastModuleProcSpace
                                                • String ID: :$:$DATA$\
                                                • API String ID: 3991446108-1004618218
                                                • Opcode ID: 6e19927233d2e1a96123b120c67781f20749fa7dc9904a0ac51ddf0edd5cadcd
                                                • Instruction ID: 099ad1844b286547888d27078e988d063d6839b65f7a10835a28c8da81067b10
                                                • Opcode Fuzzy Hash: 6e19927233d2e1a96123b120c67781f20749fa7dc9904a0ac51ddf0edd5cadcd
                                                • Instruction Fuzzy Hash: 2FD10370900209DACF24EFA8C485AEDB7B9FF14314F10411DE496E7292FB749AE9CB52
                                                Function 00875326 Relevance: 10.6, APIs: 7, Instructions: 57COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: _initterm$__getmainargs__p___initenv__p__commode__p__fmode__set_app_type
                                                • String ID:
                                                • API String ID: 4012487245-0
                                                • Opcode ID: 2ddd206118db45c755aa3a986f8e7531642974e126ec1cd9ff2a5ff1ab1d6b64
                                                • Instruction ID: 49d92bb77e9fd1890f93f8e6ce4f1409251329bfaacdf6504fb07500d230e4ea
                                                • Opcode Fuzzy Hash: 2ddd206118db45c755aa3a986f8e7531642974e126ec1cd9ff2a5ff1ab1d6b64
                                                • Instruction Fuzzy Hash: 79214D71940708EFCB51AFA8EC49E997B78FB0A721F144219F125E33A5C7B49880CB76
                                                Function 0087539D Relevance: 10.5, APIs: 7, Instructions: 43COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: _initterm$FilterXcpt__getmainargs__p___initenv__setusermatherr_controlfpexit
                                                • String ID:
                                                • API String ID: 279829931-0
                                                • Opcode ID: 90ff485bdf96b6ca5586b52bfb99910e520f203061f9c13cc20627adccb43ddf
                                                • Instruction ID: 40faf80562a87dd94400711df535911919d7a6c7cd7c08c6b1a40510343c3ce1
                                                • Opcode Fuzzy Hash: 90ff485bdf96b6ca5586b52bfb99910e520f203061f9c13cc20627adccb43ddf
                                                • Instruction Fuzzy Hash: B30125B1940608EFDB00ABA4DC4ACEE7B78FF08311B54801AF515E3265DB799880CB36
                                                Function 00841804 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 2296 841804-84183f call 874f50 EnterCriticalSection call 812c08 2301 841864 2296->2301 2302 841841-841842 2296->2302 2305 841869 2301->2305 2303 841844-841845 2302->2303 2304 84185d-841862 2302->2304 2306 841847 2303->2306 2307 841853-84185b 2303->2307 2304->2305 2308 84186c-841872 2305->2308 2309 84184e-841851 2306->2309 2307->2309 2310 841878-84187e 2308->2310 2311 8419ca-8419ce 2308->2311 2309->2308 2310->2311 2313 841884-8418a2 call 8419d3 call 812579 2310->2313 2312 84194f-841955 2311->2312 2314 8419a5-8419c7 call 841117 LeaveCriticalSection 2312->2314 2315 841957-84195e 2312->2315 2329 8418a4-8418a6 call 812688 2313->2329 2330 8418ab-8418d2 fputs 2313->2330 2317 841960-84197e 2315->2317 2318 84199d-8419a0 call 8481c2 2315->2318 2321 841986-841991 call 812579 2317->2321 2322 841980-841984 2317->2322 2318->2314 2321->2318 2334 841993-841998 call 812c08 2321->2334 2322->2318 2322->2321 2329->2330 2332 8418d4-8418e5 call 812c08 call 811fa9 2330->2332 2333 8418ea-841901 call 811f50 2330->2333 2332->2333 2341 841903-84192d fputs call 812110 fputs 2333->2341 2342 84192e-841940 call 811e77 2333->2342 2334->2318 2341->2342 2347 841942-841948 call 811e68 2342->2347 2348 84194d 2342->2348 2347->2348 2348->2312
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$CriticalSection$EnterH_prologLeave
                                                • String ID:
                                                • API String ID: 1850570545-0
                                                • Opcode ID: 19dc0a3df41e364b4380fe86a11ee355adf87af0655d8f931b350fa7d04c7b95
                                                • Instruction ID: f37a89c74c53a03ece0aa84f89d135b9e57893e258c671514a6a6151bc612b92
                                                • Opcode Fuzzy Hash: 19dc0a3df41e364b4380fe86a11ee355adf87af0655d8f931b350fa7d04c7b95
                                                • Instruction Fuzzy Hash: 3051AE31600709DFDF25DF64D898BEABBA5FF49310F00842EE95AD7291CB30A984CB52
                                                Function 008154DC Relevance: 9.1, APIs: 6, Instructions: 102COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 2350 8154dc-8154fe call 874f50 call 8178f0 2355 815521-815523 2350->2355 2356 815500-81550b CreateDirectoryW 2350->2356 2359 8155b5-8155bc GetLastError 2355->2359 2360 815529-815548 call 812ac9 call 8179f9 2355->2360 2357 815514-81551b GetLastError 2356->2357 2358 81550d-81550f 2356->2358 2357->2355 2357->2359 2363 815604-815612 2358->2363 2361 8155c2-8155ea call 816020 call 812ac9 call 8160c0 2359->2361 2362 8155be-8155c0 2359->2362 2371 8155a8-8155b4 call 811c86 2360->2371 2372 81554a-815557 CreateDirectoryW 2360->2372 2385 8155f0-8155f6 2361->2385 2386 8155ec-8155ee 2361->2386 2362->2363 2371->2359 2374 815559-81555b 2372->2374 2375 81555d-815564 GetLastError 2372->2375 2378 8155a3-8155a6 2374->2378 2379 815566-815568 2375->2379 2380 81556a-81558b call 816020 call 812ac9 call 8160c0 2375->2380 2383 8155fc-815602 call 811c86 2378->2383 2379->2378 2395 815591-815597 2380->2395 2396 81558d-81558f 2380->2396 2383->2363 2387 8155f9 2385->2387 2386->2387 2387->2383 2397 81559a-8155a2 call 811c86 2395->2397 2396->2397 2397->2378
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008154E1
                                                • CreateDirectoryW.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00815503
                                                • GetLastError.KERNEL32(?,00000000,00000000,?,00000000), ref: 00815514
                                                • CreateDirectoryW.KERNELBASE(?,00000000,00000000,00000000,?,00000000), ref: 0081554F
                                                • GetLastError.KERNEL32 ref: 0081555D
                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 008155B5
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$CreateDirectory$H_prolog
                                                • String ID:
                                                • API String ID: 798237638-0
                                                • Opcode ID: d9db8e9b884139d2bbbdef8dcdb3f13fb80d778e03a99ea681e2af1356968a3d
                                                • Instruction ID: e0f9e6955c9876973d15183d08c38ac2ef15c9756348519a37a62ab6ff45251e
                                                • Opcode Fuzzy Hash: d9db8e9b884139d2bbbdef8dcdb3f13fb80d778e03a99ea681e2af1356968a3d
                                                • Instruction Fuzzy Hash: 9131D331900619DADF14EBA8C88A7FDBB3FFF95304F140118E506E3192DB658AC5DB62
                                                Function 00830A6A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00830A6F
                                                  • Part of subcall function 0082F640: __EH_prolog.LIBCMT ref: 0082F645
                                                  • Part of subcall function 0082F931: __EH_prolog.LIBCMT ref: 0082F936
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00830B69
                                                  • Part of subcall function 00830CA5: __EH_prolog.LIBCMT ref: 00830CAA
                                                Strings
                                                • Duplicate archive path:, xrefs: 00830C8D
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow
                                                • String ID: Duplicate archive path:
                                                • API String ID: 2366012087-4000988232
                                                • Opcode ID: baf2fe44e2f29e55238f398612cba918dba060d13a054a25e425eae50accd171
                                                • Instruction ID: 0e51c478915d21db4d89cc679dadeeb180e7b0a00f2c06e4fdd3875ba6d95641
                                                • Opcode Fuzzy Hash: baf2fe44e2f29e55238f398612cba918dba060d13a054a25e425eae50accd171
                                                • Instruction Fuzzy Hash: 0C816931D00259EFCF25EFA8D991ADDB7B4FF54310F1041A9E515A72A2DB30AE44CBA2
                                                Function 008141C1 Relevance: 7.7, APIs: 5, Instructions: 226COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: wcscmp$ExceptionH_prologThrow
                                                • String ID:
                                                • API String ID: 2750596395-0
                                                • Opcode ID: 645d06745e83a3418fae22c91ef6d0757ccddf12e8bd8b4cb99d5ac62e81307a
                                                • Instruction ID: e8279249a4afbda7221842796a8030729f6313e4898233e586533e855b73b1b4
                                                • Opcode Fuzzy Hash: 645d06745e83a3418fae22c91ef6d0757ccddf12e8bd8b4cb99d5ac62e81307a
                                                • Instruction Fuzzy Hash: A2917970D0024ADECF14DFA8C485AEEBBB8FF15314F145069E515E7292DB709AC9CBA2
                                                Function 00814F4A Relevance: 7.6, APIs: 5, Instructions: 72filetimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00814F4F
                                                • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00814F8E
                                                • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,00000000), ref: 00814FCE
                                                • SetFileTime.KERNELBASE(000000FF,?,?,?), ref: 00814FF0
                                                • CloseHandle.KERNEL32(000000FF), ref: 00814FFE
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: File$Create$CloseH_prologHandleTime
                                                • String ID:
                                                • API String ID: 213185242-0
                                                • Opcode ID: 97b00f8d1c20ba5569240a002447541ba395e0e22ea13b04b1f9cb0f549a1c44
                                                • Instruction ID: 0bd55950e6d2b7c69e39cdc5bc847eb616e10815d39a35b36dc3c47b904da08a
                                                • Opcode Fuzzy Hash: 97b00f8d1c20ba5569240a002447541ba395e0e22ea13b04b1f9cb0f549a1c44
                                                • Instruction Fuzzy Hash: A6215B7194021AEFDF219FA8DC09BEEBB79FF04324F104229E524B62E0D7754A95DB90
                                                Function 0084DB7D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 192COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: !$LZMA2:$LZMA:
                                                • API String ID: 3519838083-3332058968
                                                • Opcode ID: 26c2dc7f13cb1f2ea5a7a84d59adc5c4885816ddfe497f50a0fe8041689ce879
                                                • Instruction ID: dd5301bac9302d70b6eb25d5a0f157178046266aa54a72c0358b100dc8d215fc
                                                • Opcode Fuzzy Hash: 26c2dc7f13cb1f2ea5a7a84d59adc5c4885816ddfe497f50a0fe8041689ce879
                                                • Instruction Fuzzy Hash: 62718C7090024D9FDB19DF68C599BED7BB5FF15304F2440A9E44AEB2A2CA709E84C741
                                                Function 00843F4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: =
                                                • API String ID: 2614055831-2525689732
                                                • Opcode ID: 32134e8692a12d306c973d9e9a747f4165a8bde7590de0163c3e0b9a33e9604e
                                                • Instruction ID: 2c2dade916c42a1f90697d315df0d88c41b0b284ada564331c75af4ae8aa911a
                                                • Opcode Fuzzy Hash: 32134e8692a12d306c973d9e9a747f4165a8bde7590de0163c3e0b9a33e9604e
                                                • Instruction Fuzzy Hash: DE216D32904128EFCF15EBD8D9828EEFBB9FF48310F24402AF505A2155DB315E95CBA2
                                                Function 00843DE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00843DEB
                                                • fputs.MSVCRT ref: 00843E00
                                                • fputs.MSVCRT ref: 00843E09
                                                  • Part of subcall function 00843E64: __EH_prolog.LIBCMT ref: 00843E69
                                                  • Part of subcall function 00843E64: fputs.MSVCRT ref: 00843EA6
                                                  • Part of subcall function 00843E64: fputs.MSVCRT ref: 00843EDC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: =
                                                • API String ID: 2614055831-2525689732
                                                • Opcode ID: 93d28c0fe3afe1c41e87c2388949602ad85141f325720a25c4670395b3ed8c4c
                                                • Instruction ID: f81f7f14b7a9270163a84eabd3d9c101e002a05cfc8b572879ccbe3abd254e5e
                                                • Opcode Fuzzy Hash: 93d28c0fe3afe1c41e87c2388949602ad85141f325720a25c4670395b3ed8c4c
                                                • Instruction Fuzzy Hash: 6501D631A00108EBCF05BBA8D806AEEBB79FF84714F00801AF645D2691CF348A85CFD2
                                                Function 0083125A Relevance: 6.7, APIs: 4, Instructions: 654COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0083125F
                                                • _CxxThrowException.MSVCRT(?,00882960), ref: 008313DD
                                                • _CxxThrowException.MSVCRT(?,00882960), ref: 00831A5F
                                                • _CxxThrowException.MSVCRT(0087DF1C,00882960), ref: 008313F2
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                  • Part of subcall function 00831C8C: __EH_prolog.LIBCMT ref: 00831C91
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prolog$free
                                                • String ID:
                                                • API String ID: 1223536468-0
                                                • Opcode ID: a270d847cea7d24b834202c565a644160ef436deff69241b1b55dc1007eeac64
                                                • Instruction ID: 1f943340b6aaf2b2d3710130aaa7366c92ab972bf62a640922bc579053b79cac
                                                • Opcode Fuzzy Hash: a270d847cea7d24b834202c565a644160ef436deff69241b1b55dc1007eeac64
                                                • Instruction Fuzzy Hash: 33621370904258DFCF25DFA8C988ADDBBF5FF98304F14419AE849A7252CB749A84CF91
                                                Function 008509F6 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: b266ad7ccfded45aa6609514938227fc2314ac173a9a9100ddc865069a337681
                                                • Instruction ID: 274b97c8f0d240ca1cfa0fc1784e2029e03b7687004b17d1866d30930c2883d0
                                                • Opcode Fuzzy Hash: b266ad7ccfded45aa6609514938227fc2314ac173a9a9100ddc865069a337681
                                                • Instruction Fuzzy Hash: FC51F371A0031A9FDB25DF68C884BBEB3B5FF4435AF244519E805D7241D7B4AD088F51
                                                Function 00815305 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0081530A
                                                • CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,00000001), ref: 0081532C
                                                • GetLastError.KERNEL32(?,00000000,?,00000000,00000001), ref: 00815336
                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000,00000001), ref: 0081536D
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CreateDirectory$ErrorH_prologLast
                                                • String ID:
                                                • API String ID: 1817354178-0
                                                • Opcode ID: 9f332c55566e28901e36c03875823f743becd2c3adef12801df88ae28084261f
                                                • Instruction ID: fa5394c9e1415cab21cfcdc5435ac33e276014eb6afe5bd60cef856e380e6256
                                                • Opcode Fuzzy Hash: 9f332c55566e28901e36c03875823f743becd2c3adef12801df88ae28084261f
                                                • Instruction Fuzzy Hash: 54012832D00615DFCF186BA4D8867FE7B2DFF81390F140129E911E3391CBA48DC69691
                                                Function 00831D93 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00831D98
                                                  • Part of subcall function 00834E6D: __EH_prolog.LIBCMT ref: 00834E72
                                                • GetLastError.KERNEL32(?,0087C344,-00000087,0000000D,00000000,00000000,?), ref: 008320E9
                                                Strings
                                                • Can not create output directory: , xrefs: 008320FD
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ErrorLast
                                                • String ID: Can not create output directory:
                                                • API String ID: 2901101390-3123869724
                                                • Opcode ID: 21c0c3c621a338f56889e928af615f7e3854fd27c79cb62378974ec77faa6258
                                                • Instruction ID: 81f2c584920c3c76d231eff251d23348494bb7a638a67a6b35fb1cb335f85693
                                                • Opcode Fuzzy Hash: 21c0c3c621a338f56889e928af615f7e3854fd27c79cb62378974ec77faa6258
                                                • Instruction Fuzzy Hash: 74E1AF70901249DFCF24EFA8C994AEDBBB5FF88300F144099E545E3241DB34AE89CB92
                                                Function 008481C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CountTickfputs
                                                • String ID: .
                                                • API String ID: 290905099-4150638102
                                                • Opcode ID: e6125586b05c3061ea802718ddd737ba6b0fd65874441e57f9a292b392362e7f
                                                • Instruction ID: 030995933c6d8aaa8459590fcfe90b3182abb5cea016faee7b2bf75d55069078
                                                • Opcode Fuzzy Hash: e6125586b05c3061ea802718ddd737ba6b0fd65874441e57f9a292b392362e7f
                                                • Instruction Fuzzy Hash: 42711530600B08DFCB21EF68D595AAEB7EAFF90700F10491DE196D7691DBB4B9898B11
                                                Function 00816782 Relevance: 4.6, APIs: 3, Instructions: 64fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00816787
                                                  • Part of subcall function 00816834: FindCloseChangeNotification.KERNELBASE(00000000,?,00816797,000000FF,00000009,00000001), ref: 0081683F
                                                • CreateFileW.KERNELBASE(?,00000001,00000009,00000000,000000FF,00000009,00000000,00000001,00000009,000000FF,00000009,00000001), ref: 008167CD
                                                • CreateFileW.KERNEL32(00000001,00000001,00000001,00000000,000000FF,00000009,00000000,00000000,00000001,00000009,000000FF), ref: 0081680E
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CreateFile$ChangeCloseFindH_prologNotification
                                                • String ID:
                                                • API String ID: 3273702577-0
                                                • Opcode ID: fb957476a67221b1c4dcbdf2d582fa9bf825b4fe90e43a9ebec228505333fba4
                                                • Instruction ID: 4cd8010e701e79e768c18f3e0af74d89c2ddad5040628244b06bad981a57d682
                                                • Opcode Fuzzy Hash: fb957476a67221b1c4dcbdf2d582fa9bf825b4fe90e43a9ebec228505333fba4
                                                • Instruction Fuzzy Hash: 9B11547280020AEFCF119FA8DC418EEBB7AFF44354B108A2DF960A61A1D7359DE5DB51
                                                Function 00843E64 Relevance: 4.6, APIs: 3, Instructions: 60COMMON
                                                Download Yara Rule
                                                APIs
                                                • fputs.MSVCRT ref: 00843EDC
                                                • fputs.MSVCRT ref: 00843EA6
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                • __EH_prolog.LIBCMT ref: 00843E69
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog$fputc
                                                • String ID:
                                                • API String ID: 1037621496-0
                                                • Opcode ID: 82f4554c1dd3cbb5e3d4c787810e50d5ae41671e1b4bfcd136fd62b9660e58fb
                                                • Instruction ID: 0ca762c7629d393509a638189d6b30e2504001de01f859511b6bffd29eaa2a95
                                                • Opcode Fuzzy Hash: 82f4554c1dd3cbb5e3d4c787810e50d5ae41671e1b4bfcd136fd62b9660e58fb
                                                • Instruction Fuzzy Hash: 9D117331A045149BDF05BBA9D81B5EE7B79FF80720F000029F606E2691DF2559868BD6
                                                Function 00815017 Relevance: 4.6, APIs: 3, Instructions: 54COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0081501C
                                                • SetFileAttributesW.KERNELBASE(?,?), ref: 00815042
                                                • SetFileAttributesW.KERNEL32(?,?,00000000), ref: 00815077
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AttributesFile$H_prolog
                                                • String ID:
                                                • API String ID: 3790360811-0
                                                • Opcode ID: 920c23e134f26e5007666e90ec51d86b8285c8e2217e52e4749ff801467cd4f8
                                                • Instruction ID: 9fc715ef568c1845c3ccd518ba3db6e00b731b0ed2ef18d6edde147d2e5a3344
                                                • Opcode Fuzzy Hash: 920c23e134f26e5007666e90ec51d86b8285c8e2217e52e4749ff801467cd4f8
                                                • Instruction Fuzzy Hash: 6101F572D00A16DBCF20ABE8D8415FEB77DFF88350F14442AE915E3255CB398C959691
                                                Function 00816043 Relevance: 4.5, APIs: 3, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00816048
                                                • GetFileAttributesW.KERNELBASE(?,00000001,?,00000000,00000001), ref: 00816068
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • GetFileAttributesW.KERNELBASE(00000002,00000000,00000001,?,00000000,00000001), ref: 00816097
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AttributesFile$H_prologfree
                                                • String ID:
                                                • API String ID: 86656847-0
                                                • Opcode ID: 0c2901e7b1596b9a240fc6c65b9e3f314117ee7ffc4bac0fa6d05db583f8ace9
                                                • Instruction ID: 1b1082723d19bd36dfc7bd3293ebefad8631113e09736151e7a38215435a2fae
                                                • Opcode Fuzzy Hash: 0c2901e7b1596b9a240fc6c65b9e3f314117ee7ffc4bac0fa6d05db583f8ace9
                                                • Instruction Fuzzy Hash: 2F01F476A005149BCF2177BCA8865FEBB6DFF48330F140229E911E3282DF648DE59692
                                                Function 00841544 Relevance: 4.5, APIs: 3, Instructions: 33COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00841549
                                                • EnterCriticalSection.KERNEL32(0088C7F0), ref: 0084155A
                                                • LeaveCriticalSection.KERNEL32(0088C7F0), ref: 00841592
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterH_prologLeave
                                                • String ID:
                                                • API String ID: 367238759-0
                                                • Opcode ID: d8541429d81420efae1a612bc3a49cbf945abce0539771e19e40569b405a4a55
                                                • Instruction ID: 385b53e42239c12bb27c8cac8c87134770a5b158e4d63a7ec4f1533e1de5d18a
                                                • Opcode Fuzzy Hash: d8541429d81420efae1a612bc3a49cbf945abce0539771e19e40569b405a4a55
                                                • Instruction Fuzzy Hash: 4AF03735610604DFCB08EF59D448BA9B7A5FF86711F01806EE41AE7365CB70D949CBA1
                                                Function 008414E4 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008414E9
                                                • EnterCriticalSection.KERNEL32(0088C7F0), ref: 008414FA
                                                • LeaveCriticalSection.KERNEL32(0088C7F0), ref: 0084152C
                                                  • Part of subcall function 008481C2: GetTickCount.KERNEL32 ref: 008481D7
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$CountEnterH_prologLeaveTick
                                                • String ID:
                                                • API String ID: 2547919631-0
                                                • Opcode ID: dce7abedc51dfae6147420e43effdc663193362961d0b5bf00063e1e76222a7a
                                                • Instruction ID: 8575b97002c839c27686f1c5ba1f64ea5145bd095fa86a7c24277171232847dc
                                                • Opcode Fuzzy Hash: dce7abedc51dfae6147420e43effdc663193362961d0b5bf00063e1e76222a7a
                                                • Instruction Fuzzy Hash: 2EF04475A10214DBCB04EF58D848B99B7A4FB89300F01806EE80AE7351CB70D948CBA5
                                                Function 00848093 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
                                                Download Yara Rule
                                                APIs
                                                • fputs.MSVCRT ref: 008480FC
                                                  • Part of subcall function 0081244E: _CxxThrowException.MSVCRT(00000000,00882800), ref: 00812470
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrowfputs
                                                • String ID:
                                                • API String ID: 1334390793-399585960
                                                • Opcode ID: b7f35e35430a5c62d1865b3a5ec41ec0469ef20afff9a7db4a2c3b7e3149f9b2
                                                • Instruction ID: 203602429ebacd2b45bdda88bf2b2c611d47483a5b4364d1c5d96159b1b5b5dd
                                                • Opcode Fuzzy Hash: b7f35e35430a5c62d1865b3a5ec41ec0469ef20afff9a7db4a2c3b7e3149f9b2
                                                • Instruction Fuzzy Hash: A611BC716047449FDB25CF58C885BAABBEAFF8A304F04406EE186DB250DBB5BC44CB61
                                                Function 00841D54 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: Open
                                                • API String ID: 1795875747-71445658
                                                • Opcode ID: 92ea7e216e7aa5b5552caab587678bd12f24780a0e5289ef1bc417f406439a28
                                                • Instruction ID: a9c49574b9682b554c3500f76a271c506a0d9001a0ece73a67e038796d49e2ce
                                                • Opcode Fuzzy Hash: 92ea7e216e7aa5b5552caab587678bd12f24780a0e5289ef1bc417f406439a28
                                                • Instruction Fuzzy Hash: 5B11A3315047089FDB64AF78D885ADAF7A5FF15310F40852FE49AC3212DB71A880CF51
                                                Function 00812110 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: F{v
                                                • API String ID: 1795875747-2160915812
                                                • Opcode ID: 3a573871617af64bf5fb090337e5f12f0503d7a21c89faf3d520a9cf8493e533
                                                • Instruction ID: c18db5a17ecdaea151f2efbe09fc959ce9b63f519a212be878c72c557902ad13
                                                • Opcode Fuzzy Hash: 3a573871617af64bf5fb090337e5f12f0503d7a21c89faf3d520a9cf8493e533
                                                • Instruction Fuzzy Hash: 09D01232504118ABDF146F98EC49CDD7BACFF08214704442EF545A2194EAB5E5548BA5
                                                Function 00811E77 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputc
                                                • String ID: F{v
                                                • API String ID: 1992160199-2160915812
                                                • Opcode ID: 25ec6cef2a6ce069bc93e44a095d57f0b1197f6cf41871e076facd0634df43f5
                                                • Instruction ID: a9647b18c552c2b320d5fabc248302a4307b44df5dae63b7e4a36708d15ea3e0
                                                • Opcode Fuzzy Hash: 25ec6cef2a6ce069bc93e44a095d57f0b1197f6cf41871e076facd0634df43f5
                                                • Instruction Fuzzy Hash: A4B092323082209BE6581A98BC0AA80BB98EB0A721B21006FF548C21959AA15C818AA5
                                                Function 00851DDB Relevance: 3.2, APIs: 2, Instructions: 203COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00851DE0
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00852012
                                                  • Part of subcall function 00811C5F: malloc.MSVCRT ref: 00811C65
                                                  • Part of subcall function 00811C5F: _CxxThrowException.MSVCRT(?,00882738), ref: 00811C7F
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prologmalloc
                                                • String ID:
                                                • API String ID: 3044594480-0
                                                • Opcode ID: 1351f010b19cbbb0a9a7a9865dcc5680b0387ae203278b877f049934f1fd693c
                                                • Instruction ID: 7fc38373ff1a8c19eab7ffcef58cfd9bace2c1ffa14ef667b089e97ee3f23107
                                                • Opcode Fuzzy Hash: 1351f010b19cbbb0a9a7a9865dcc5680b0387ae203278b877f049934f1fd693c
                                                • Instruction Fuzzy Hash: F48148709002599FCF21DFA8C985AEEBBB5FF09304F144199E945E7252CB30AE89CB61
                                                Function 008284C3 Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 35e8cf872566e002c84d94cfc289bb069085f7cfe4ccb07475e92ef054ee2729
                                                • Instruction ID: 6a74620e2a51d03c27e44dfd85c8557802bdfed8c281e10c502e23c1e59703dd
                                                • Opcode Fuzzy Hash: 35e8cf872566e002c84d94cfc289bb069085f7cfe4ccb07475e92ef054ee2729
                                                • Instruction Fuzzy Hash: BC518BB1506B91DFDB21CF34D494AE6BBE1FF95300F08895DE4AA8B202DA31AC84CF50
                                                Function 0081539B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008153A0
                                                  • Part of subcall function 00816043: __EH_prolog.LIBCMT ref: 00816048
                                                  • Part of subcall function 00816043: GetFileAttributesW.KERNELBASE(?,00000001,?,00000000,00000001), ref: 00816068
                                                  • Part of subcall function 00816043: GetFileAttributesW.KERNELBASE(00000002,00000000,00000001,?,00000000,00000001), ref: 00816097
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AttributesFileH_prolog
                                                • String ID:
                                                • API String ID: 3244726999-0
                                                • Opcode ID: ee3fc407978088a9187746dbc94593263adadace575084d9eebf0e59bcd168fe
                                                • Instruction ID: 675fa093297f7d8ff7ff67abdca3e78cc480d603030a30a470e574b17b4e1bf3
                                                • Opcode Fuzzy Hash: ee3fc407978088a9187746dbc94593263adadace575084d9eebf0e59bcd168fe
                                                • Instruction Fuzzy Hash: 1A3100B190091ACACF24EBA8D4814FDB37DFF95305F100469E552F3291DB355DC68BAA
                                                Function 00838E15 Relevance: 3.1, APIs: 2, Instructions: 106COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00838E1A
                                                • GetLastError.KERNEL32(?,?,00000000), ref: 00838EB9
                                                  • Part of subcall function 00811C5F: malloc.MSVCRT ref: 00811C65
                                                  • Part of subcall function 00811C5F: _CxxThrowException.MSVCRT(?,00882738), ref: 00811C7F
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorExceptionH_prologLastThrowmalloc
                                                • String ID:
                                                • API String ID: 3967182680-0
                                                • Opcode ID: 5033eca402a1eb9709d5057939cde82252ece3f295b66b666a3c6ff2272cc17a
                                                • Instruction ID: 320460ab98cd97852c91faeb5a624264357a8a0b1f06d6021e6db033da3b3172
                                                • Opcode Fuzzy Hash: 5033eca402a1eb9709d5057939cde82252ece3f295b66b666a3c6ff2272cc17a
                                                • Instruction Fuzzy Hash: 70418A71A00345DFCB14DFA8C9886AEBBB5FF84314F244469E55AE7281CF709E45CBA1
                                                Function 008168BB Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetFilePointer.KERNELBASE(000000FF,?,00000000,?,000000FF,?,000000FF,?,0081694B,?,?,00000000,?,00816986,?,?), ref: 008168F9
                                                • GetLastError.KERNEL32(?,0081694B,?,?,00000000,?,00816986,?,?,?,?,00000000), ref: 00816906
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorFileLastPointer
                                                • String ID:
                                                • API String ID: 2976181284-0
                                                • Opcode ID: 61d10a553c192d6d08258e041f8175803ab988c3becc14ded4ac35ba21f5b14b
                                                • Instruction ID: c7cf4b9fee8c12ca3c8bedf42d53d200f0ed67fee2422ad68ad829d2a2ae80b0
                                                • Opcode Fuzzy Hash: 61d10a553c192d6d08258e041f8175803ab988c3becc14ded4ac35ba21f5b14b
                                                • Instruction Fuzzy Hash: F5112571901208AFCB11CF64CC449DA7BE9FF05328B24C169F859D7255E372DD91DB60
                                                Function 00839951 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00839956
                                                  • Part of subcall function 008160C0: __EH_prolog.LIBCMT ref: 008160C5
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • _CxxThrowException.MSVCRT(?,00882800), ref: 008399B5
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrowfree
                                                • String ID:
                                                • API String ID: 1371406966-0
                                                • Opcode ID: a9489cc2b38290e1024db78d4680ff8a854bc7c7c0b6a5b6936d24aee8dc9b1c
                                                • Instruction ID: dea5f8f517d41a2dccd21e5b0ff6cae9cbf4fd71f6dbb77ec0dcd01651cea2b3
                                                • Opcode Fuzzy Hash: a9489cc2b38290e1024db78d4680ff8a854bc7c7c0b6a5b6936d24aee8dc9b1c
                                                • Instruction Fuzzy Hash: 7A010076940604AACB25EF28D441BDEBBF5FF85320F10811DE9D6A32A1CB74A688CB51
                                                Function 00811E8A Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfputs
                                                • String ID:
                                                • API String ID: 1798449854-0
                                                • Opcode ID: 3729d92f7f773608fb24855c76e6c2f03da1960c291ad06585e32a77e1d28d4b
                                                • Instruction ID: 946fcadb2ef325af2ab87fe20898005dd5891fc46f43c0063f2ed549aae15181
                                                • Opcode Fuzzy Hash: 3729d92f7f773608fb24855c76e6c2f03da1960c291ad06585e32a77e1d28d4b
                                                • Instruction Fuzzy Hash: 39117C32800119DACF05EB98D946AEDBB79FF54324F104169EA01B2192EB711F94DBA1
                                                Function 00852BB0 Relevance: 3.0, APIs: 2, Instructions: 39COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00852BB5
                                                  • Part of subcall function 00852786: __EH_prolog.LIBCMT ref: 0085278B
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00852C00
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow
                                                • String ID:
                                                • API String ID: 2366012087-0
                                                • Opcode ID: f0a16203b74967e50a430bdc4ef915575d97f49188262318e92a8906e7791333
                                                • Instruction ID: 30106ecbc986d5a0c94de7e8932e27755355f9543c3b6e7c7849aa1ab6030945
                                                • Opcode Fuzzy Hash: f0a16203b74967e50a430bdc4ef915575d97f49188262318e92a8906e7791333
                                                • Instruction Fuzzy Hash: 4801F236404248BEDF02DF98C805BEE7FB8FB06310F048049F948AA212C7B5E958CB62
                                                Function 00818346 Relevance: 3.0, APIs: 2, Instructions: 31memorystringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • strlen.MSVCRT ref: 00818353
                                                • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0081835E
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AllocStringstrlen
                                                • String ID:
                                                • API String ID: 3696942006-0
                                                • Opcode ID: 5aa5ae74fd657d0499178774352080ecbae3d77c4fe585653beefb2381f366fc
                                                • Instruction ID: d790d8d8436455406d0a470fee6704500f7a32ab7858fa8faa7ecb6942212fff
                                                • Opcode Fuzzy Hash: 5aa5ae74fd657d0499178774352080ecbae3d77c4fe585653beefb2381f366fc
                                                • Instruction Fuzzy Hash: 7CE026223188A1068735157D3C19EFB128CFFC7B2A72D406EF05AC6345DD01CCC382A4
                                                Function 0084145C Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00841461
                                                • fputs.MSVCRT ref: 00841491
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfputcfputsfree
                                                • String ID:
                                                • API String ID: 195749403-0
                                                • Opcode ID: d8f1c30d397fbafec5f60523de3c2567d05f62b5d8b3b6e895d09d6ca6c07d09
                                                • Instruction ID: 47502c78b9c940cc6959430a758d5b0b68245999bc7c004f13070bff7e203660
                                                • Opcode Fuzzy Hash: d8f1c30d397fbafec5f60523de3c2567d05f62b5d8b3b6e895d09d6ca6c07d09
                                                • Instruction Fuzzy Hash: 81F0BE32800114CBCF05EF98E50A7EEBBB4FF04710F00802EE506A3595DF349984CB85
                                                Function 00846F82 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID:
                                                • API String ID: 1795875747-0
                                                • Opcode ID: 7f56cc64b4ccffc6da6373ab9a95e0672ed47ad36ef8b5d541f105f40c6519c6
                                                • Instruction ID: 4d7023817f7f8a10b55696234db227b928f5871a782ce1fb81004d1a81636997
                                                • Opcode Fuzzy Hash: 7f56cc64b4ccffc6da6373ab9a95e0672ed47ad36ef8b5d541f105f40c6519c6
                                                • Instruction Fuzzy Hash: 6CD0C23B24A1285E9A151F09FC01C803799FBC6231325003FEA80972649E135C685BA0
                                                Function 0086E940 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorLast_beginthreadex
                                                • String ID:
                                                • API String ID: 4034172046-0
                                                • Opcode ID: 7a1c11aa0862eb662e95d8c7a0fb9f50be96f7a548b499cb9bd83bb8dab7a521
                                                • Instruction ID: 35c436b13d5603301407bd482bd41bd7fc7bfd4a879c2db39adb2fc908889850
                                                • Opcode Fuzzy Hash: 7a1c11aa0862eb662e95d8c7a0fb9f50be96f7a548b499cb9bd83bb8dab7a521
                                                • Instruction Fuzzy Hash: 64E08CB6204202ABF3508B649C09F677A98FFA0B41F40842DBA48D7184E660C850C7B5
                                                Function 008188FC Relevance: 3.0, APIs: 2, Instructions: 7COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(?,?,0081891D), ref: 00818901
                                                • GetProcessAffinityMask.KERNEL32(00000000), ref: 00818908
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Process$AffinityCurrentMask
                                                • String ID:
                                                • API String ID: 1231390398-0
                                                • Opcode ID: a3e03c25937d45832c830fcbfd72f28a242de435dab42aba684304ee8357ffa4
                                                • Instruction ID: edcc80336e3a0fa7ee3e971774f8d684bee099ae49b52ab0a5d1764db989aa54
                                                • Opcode Fuzzy Hash: a3e03c25937d45832c830fcbfd72f28a242de435dab42aba684304ee8357ffa4
                                                • Instruction Fuzzy Hash: 95B092B1400504EFCE009BB09D0CD2A3A2CBB04209314444DB10AC3014C636C041CBA0
                                                Function 008193EE Relevance: 2.7, APIs: 2, Instructions: 223COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorLastmemcpy
                                                • String ID:
                                                • API String ID: 2523627151-0
                                                • Opcode ID: 6337c48b1acfb83ef00f72192707e6fe8b9402008cd0ca73a942c2999574606e
                                                • Instruction ID: 08a89a81b7de5044d2fe6ac3bfce327b50b299d9bf9a2dba28c87426044244a7
                                                • Opcode Fuzzy Hash: 6337c48b1acfb83ef00f72192707e6fe8b9402008cd0ca73a942c2999574606e
                                                • Instruction Fuzzy Hash: 57815671600B059FDB64CE25C9A0AEAB3FAFF54314F144A2DE886D7A40D734F886CB55
                                                Function 0086DB20 Relevance: 2.6, APIs: 2, Instructions: 66COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnterCriticalSection.KERNEL32(000000B0,00000000,?,00000000,0086D164,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 0086DB2E
                                                • LeaveCriticalSection.KERNEL32(000000B0,?,00000000), ref: 0086DBF6
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeave
                                                • String ID:
                                                • API String ID: 3168844106-0
                                                • Opcode ID: e12a1f9f1edb939079fcfb78e63755493ab6ef6850b75bb841b702f75a830e05
                                                • Instruction ID: e55c183cea0663767d49bcc73ccba60746bbccfc92f3490017ed5c2a33826731
                                                • Opcode Fuzzy Hash: e12a1f9f1edb939079fcfb78e63755493ab6ef6850b75bb841b702f75a830e05
                                                • Instruction Fuzzy Hash: A321AF75704B008FD764CA29D480BA7B3E6FF8A750F15882DE5AEC7304DB30A845CB62
                                                Function 00811C5F Relevance: 2.5, APIs: 2, Instructions: 15COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrowmalloc
                                                • String ID:
                                                • API String ID: 2436765578-0
                                                • Opcode ID: 13353dbfbfb4c1186a490fadc24092b9409c30d5220c866bc39b90f00775cdc0
                                                • Instruction ID: 9e2a4340bfe506bd6b0b2dc3c18e313cc1640eae3dd4d0de4b9c4a88823408a9
                                                • Opcode Fuzzy Hash: 13353dbfbfb4c1186a490fadc24092b9409c30d5220c866bc39b90f00775cdc0
                                                • Instruction Fuzzy Hash: E3D0A73504424C7A9F007FA198088CD3F5CEF01660740D015F92CCE116D530C7D08790
                                                Function 0082FA08 Relevance: 2.1, APIs: 1, Instructions: 610COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082FA0D
                                                  • Part of subcall function 008160C0: __EH_prolog.LIBCMT ref: 008160C5
                                                  • Part of subcall function 0083049F: __EH_prolog.LIBCMT ref: 008304A4
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$free
                                                • String ID:
                                                • API String ID: 2654054672-0
                                                • Opcode ID: c5ad6c11ff128e539c2e331f2ffc763523c38fea83f535147f5fad9471eebf69
                                                • Instruction ID: 3bcfa6e2bdb9ccce9d8862b5f517e06bae5d10a9ff0db984f81b85012e167099
                                                • Opcode Fuzzy Hash: c5ad6c11ff128e539c2e331f2ffc763523c38fea83f535147f5fad9471eebf69
                                                • Instruction Fuzzy Hash: 00426A71900259DFCF21EFA8D591AEDBBB5FF48304F108069EA05E7252DB309E85CB92
                                                Function 0084C985 Relevance: 2.1, APIs: 1, Instructions: 596COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084C98A
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfree
                                                • String ID:
                                                • API String ID: 1978129608-0
                                                • Opcode ID: 7be26fdecb16a29e255b2cc846b815128494ed751a4a8b9fc79394512f998f0f
                                                • Instruction ID: 01ae568694766e623a098d39a8857409fa32aa96e898892ec11fb7cc4518d2bf
                                                • Opcode Fuzzy Hash: 7be26fdecb16a29e255b2cc846b815128494ed751a4a8b9fc79394512f998f0f
                                                • Instruction Fuzzy Hash: 3942597090124DDFDB11CFA8C484BADBBB9FF49304F284099E805EB291DB75AE45CB21
                                                Function 00852786 Relevance: 1.8, APIs: 1, Instructions: 332COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 4c82131fe2bde17f1d0b86036a30df4dfed4e9320132aa3650f70a9a3b5b1c87
                                                • Instruction ID: c477ac910f675e59ed9c4a9685e4f7d40b13d60c58f992c147f5d90857fd4088
                                                • Opcode Fuzzy Hash: 4c82131fe2bde17f1d0b86036a30df4dfed4e9320132aa3650f70a9a3b5b1c87
                                                • Instruction Fuzzy Hash: 23D16D70A0025ADFCF25DFA8C880AEDBBB2FF49315F204529E855E7251DB71AD48CB91
                                                Function 0084E6D7 Relevance: 1.6, APIs: 1, Instructions: 139COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084E6DC
                                                  • Part of subcall function 00852BB0: __EH_prolog.LIBCMT ref: 00852BB5
                                                  • Part of subcall function 00852BB0: _CxxThrowException.MSVCRT(?,00889E68), ref: 00852C00
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow
                                                • String ID:
                                                • API String ID: 2366012087-0
                                                • Opcode ID: 397a9a04ccfcfb6b1d47542a81d3047a46489aa593fedff870d3c962b0d7fe35
                                                • Instruction ID: 381d8b2d04e01395fde006eaaa89c5354edbbc5b2993da4790504b509010d526
                                                • Opcode Fuzzy Hash: 397a9a04ccfcfb6b1d47542a81d3047a46489aa593fedff870d3c962b0d7fe35
                                                • Instruction Fuzzy Hash: 10514C75900289DFCB11CFA8C988B9EBBB4FF49304F1444ADE84AD7242C7759E85DB21
                                                Function 0082220D Relevance: 1.6, APIs: 1, Instructions: 127COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 3e7338923548ad454a21cd7a74aa9b279ce805ba3f316f7c104904229a6087bb
                                                • Instruction ID: 9dd48d26de864b3bf6e4b583b6cd9ee531633dfe14b2401e53d5d0e3f77c62c8
                                                • Opcode Fuzzy Hash: 3e7338923548ad454a21cd7a74aa9b279ce805ba3f316f7c104904229a6087bb
                                                • Instruction Fuzzy Hash: 52513C74A0061AEFCB14CFA4D4809BEFBB1FF49304B104959E592EB751D732A995CF90
                                                Function 0084C662 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 83320bd4064a07000417dfe3acb8b9c2d9decaf247b94eacd375991b0f35bcab
                                                • Instruction ID: cadb140b2d4c41f56bd34c12483106b1c9c0255e2476e0d860ed2f1581378f03
                                                • Opcode Fuzzy Hash: 83320bd4064a07000417dfe3acb8b9c2d9decaf247b94eacd375991b0f35bcab
                                                • Instruction Fuzzy Hash: F3419970A02649EFDB60CF68C484B6ABBA8FF15354F148A6DD496CB691D770E980CB90
                                                Function 00825E79 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00825E7E
                                                  • Part of subcall function 00825FED: __EH_prolog.LIBCMT ref: 00825FF2
                                                  • Part of subcall function 00811C5F: malloc.MSVCRT ref: 00811C65
                                                  • Part of subcall function 00811C5F: _CxxThrowException.MSVCRT(?,00882738), ref: 00811C7F
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrowmalloc
                                                • String ID:
                                                • API String ID: 3744649731-0
                                                • Opcode ID: d51b2fc6b86e19609f3eafec3b5418f50d14ff8acd768f766e2821e3f9915af0
                                                • Instruction ID: 21bb7665101ae77c015dce8212523d9d8456c1f01ba3fde4fd575f1fe95b2dc6
                                                • Opcode Fuzzy Hash: d51b2fc6b86e19609f3eafec3b5418f50d14ff8acd768f766e2821e3f9915af0
                                                • Instruction Fuzzy Hash: E741E2B0801B44CFD321DFA9C18469AFBF4FF19304F5488AEC59A97652D7B0A648CB62
                                                Function 0084674E Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00846753
                                                  • Part of subcall function 008466DE: __EH_prolog.LIBCMT ref: 008466E3
                                                  • Part of subcall function 0084688E: __EH_prolog.LIBCMT ref: 00846893
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: d9d6f2c8f3001672dcaa09955c0d7b7cab0f83c37432d611303219298c5c6d85
                                                • Instruction ID: 2ccbbecb9b50e668a3bf2b226d3517166ef436d9dfd8f6b10c96f765b50c68ce
                                                • Opcode Fuzzy Hash: d9d6f2c8f3001672dcaa09955c0d7b7cab0f83c37432d611303219298c5c6d85
                                                • Instruction Fuzzy Hash: 7A41E771445784DEC322DF69C094ADAFFE4BF25300F49C8AED49A97262D770A648CB22
                                                Function 0082F931 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 73b3334b03be17a14b92410fd72fd9dbe0947b28c93da5ebc289ed1c32a91e7f
                                                • Instruction ID: a860ee2d9bc46d63cd2b7f2597f0136bf71e149ee5374019968fa9c3b4cfc622
                                                • Opcode Fuzzy Hash: 73b3334b03be17a14b92410fd72fd9dbe0947b28c93da5ebc289ed1c32a91e7f
                                                • Instruction Fuzzy Hash: 89312D70900129EFCB14DF99D9919AEBBB5FF84354B20813EE65AA7252D7309D81CF60
                                                Function 008139DE Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 97bbf434b3384f860510f4fce53cc4646dd820bfe81be8fce3cc5208b2c52163
                                                • Instruction ID: 719c9aeaab3aa41209f8c40e340a83cf17c532dfc831df31428668d30db8b963
                                                • Opcode Fuzzy Hash: 97bbf434b3384f860510f4fce53cc4646dd820bfe81be8fce3cc5208b2c52163
                                                • Instruction Fuzzy Hash: 8F117C71D005268ECF18EBA8D8958FEF3BAFF84700B008529E125E7155EF34AA55C791
                                                Function 0082F640 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082F645
                                                  • Part of subcall function 00825A91: __EH_prolog.LIBCMT ref: 00825A96
                                                  • Part of subcall function 00825A91: GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,76778E30), ref: 00825AA8
                                                  • Part of subcall function 00825A91: OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,76778E30), ref: 00825ABF
                                                  • Part of subcall function 00825A91: LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00825AE1
                                                  • Part of subcall function 00825A91: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,76778E30), ref: 00825AF6
                                                  • Part of subcall function 00825A91: GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,76778E30), ref: 00825B00
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                • String ID:
                                                • API String ID: 1532160333-0
                                                • Opcode ID: f8446a199665b1ef825ca2c2329d63a81fde750a8ed54aa34a44682318f37d7f
                                                • Instruction ID: ea43c77c1cba25911ea9c1861b99bdf9e62e5f859f1dd1f5ebd48706ae044b0e
                                                • Opcode Fuzzy Hash: f8446a199665b1ef825ca2c2329d63a81fde750a8ed54aa34a44682318f37d7f
                                                • Instruction Fuzzy Hash: 542113B1806B908FC321CF6A85C1686FBF0FB19614B908A6ED19E93B12C774A548CF55
                                                Function 008282FE Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: ad761ffe2fa701785dc936288b9c20b6dceed89a0d4fa84ae227d4a15126a965
                                                • Instruction ID: d799a7aa97f7bedf4eca4847b47548a3deb217a60994fa8886513ec4e1baa6aa
                                                • Opcode Fuzzy Hash: ad761ffe2fa701785dc936288b9c20b6dceed89a0d4fa84ae227d4a15126a965
                                                • Instruction Fuzzy Hash: 24118E7150A258EFCB05CF68D888EA9BBA5FF49304F1981F9E4099F222C7769984CB50
                                                Function 0082650D Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 4262a9f8f0863c14d77fa34df1346ab156d61921dd18e6395e73df09ca7bb053
                                                • Instruction ID: e3357d1a8de51320b18d4d5240773632f7221b6fe7696fe306850244c5f4acbf
                                                • Opcode Fuzzy Hash: 4262a9f8f0863c14d77fa34df1346ab156d61921dd18e6395e73df09ca7bb053
                                                • Instruction Fuzzy Hash: 6D116AB1900614EFCB25DFA8D6409EABBF4FF08300F14886AE55AD7214E330EE90CB90
                                                Function 00830E6F Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00830E74
                                                  • Part of subcall function 008160C0: __EH_prolog.LIBCMT ref: 008160C5
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: f52c848d6d60a743ad300e51dfd8084b7e1cfbc5fcc1919d3d26df6d8f8cc713
                                                • Instruction ID: 1716c61e76cd86d7db0f093ce77c56cc8b3fd4e515a19b197b71f40a3a1bf4f5
                                                • Opcode Fuzzy Hash: f52c848d6d60a743ad300e51dfd8084b7e1cfbc5fcc1919d3d26df6d8f8cc713
                                                • Instruction Fuzzy Hash: A901B571A001188ACF24FBACD5127EDBB79FF84324F004069E502F3296DF704D99CAA1
                                                Function 0084D52B Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084D530
                                                  • Part of subcall function 0084D5DF: __EH_prolog.LIBCMT ref: 0084D5E4
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 839100e1cc1b1ba37355f9f4200ee17f4f9ac39fbe1719719f39f99e32fbe1bf
                                                • Instruction ID: 7ba53cdf86cda166ca163c4f0f09dccfb178f2300fb00e8ce5565f85f3fb2b97
                                                • Opcode Fuzzy Hash: 839100e1cc1b1ba37355f9f4200ee17f4f9ac39fbe1719719f39f99e32fbe1bf
                                                • Instruction Fuzzy Hash: 7A1104B18007848FC721DFA9C08868AFBE4FF05304F50C8AED5AE97711DB74A648CB51
                                                Function 0084400A Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: bff8902907af6242a2a8ba10be01cf488ee9d423a92d7088797d4bd259d36fc4
                                                • Instruction ID: 6cce8f0a44810ffeb6d0000c2327b5655a1b77faa245f91622c2202d65201559
                                                • Opcode Fuzzy Hash: bff8902907af6242a2a8ba10be01cf488ee9d423a92d7088797d4bd259d36fc4
                                                • Instruction Fuzzy Hash: 3CF04972E1001AEBCB04EF98D840AEFFB79FF94790B10815AF529E7251DB348A15CB91
                                                Function 0084A9C8 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084A9CD
                                                  • Part of subcall function 00822BCB: __EH_prolog.LIBCMT ref: 00822BD0
                                                  • Part of subcall function 00822B1D: __EH_prolog.LIBCMT ref: 00822B22
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                  • Part of subcall function 0084AA41: __EH_prolog.LIBCMT ref: 0084AA46
                                                  • Part of subcall function 008229F8: __EH_prolog.LIBCMT ref: 008229FD
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$free
                                                • String ID:
                                                • API String ID: 2654054672-0
                                                • Opcode ID: 1ed4137678f01b0492ed184463e7bacafa0509318be835b2ea9bbf167aa65a6b
                                                • Instruction ID: 99c049fbed4d5bfbd61b9782d6c23d3aa0ebdd1f26281a4f74d38c71a8967e7f
                                                • Opcode Fuzzy Hash: 1ed4137678f01b0492ed184463e7bacafa0509318be835b2ea9bbf167aa65a6b
                                                • Instruction Fuzzy Hash: 02F0F471904664DECB19EF6CD81679DBBE4FF04314F10468DE196E32C2CBB85A448746
                                                Function 0084A977 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084A97C
                                                  • Part of subcall function 0084A9C8: __EH_prolog.LIBCMT ref: 0084A9CD
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$free
                                                • String ID:
                                                • API String ID: 2654054672-0
                                                • Opcode ID: cd673be41d015e823f5b18f0cf4b5bb633d0f5e30d5710c0201c644b02bfbbcd
                                                • Instruction ID: 67e766e941e078c6085f965f8bc9a38bc2af7443d7e83a3dc76208626b9b20bd
                                                • Opcode Fuzzy Hash: cd673be41d015e823f5b18f0cf4b5bb633d0f5e30d5710c0201c644b02bfbbcd
                                                • Instruction Fuzzy Hash: B4F0E2729416249BDB299B4CD88179EFBACFF94320F01411AE421EB2018BB0DC008682
                                                Function 008264A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 5689bb23bbc5af9f99facbe0c58cb7f28c579576fa78b2534241ef51cf19f980
                                                • Instruction ID: 1e7a383293924aa77fd5f86b450c10ba086eae48b65f2110f2113b0b7018d447
                                                • Opcode Fuzzy Hash: 5689bb23bbc5af9f99facbe0c58cb7f28c579576fa78b2534241ef51cf19f980
                                                • Instruction Fuzzy Hash: 36F03771A04254EFD714CF58D848FAA7BE8FB48324F0480BAE049DB2A1D370E940CB64
                                                Function 0084D5DF Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084D5E4
                                                  • Part of subcall function 0081EA53: __EH_prolog.LIBCMT ref: 0081EA58
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: c5984ded01bccb0b8be2a964ce38a9abfeb36a5e180875c03292f9d0455490dd
                                                • Instruction ID: 27b6acf75731f4cccfcac8d61c8b62e24767db42c8ec6a6a6c8f34dc385535b5
                                                • Opcode Fuzzy Hash: c5984ded01bccb0b8be2a964ce38a9abfeb36a5e180875c03292f9d0455490dd
                                                • Instruction Fuzzy Hash: 30F0FE3290AFD0DDC717DBBC440118ABEF4AF65500B04499F91E6D3B13C660E608C366
                                                Function 0081150C Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00811511
                                                  • Part of subcall function 00811C5F: malloc.MSVCRT ref: 00811C65
                                                  • Part of subcall function 00811C5F: _CxxThrowException.MSVCRT(?,00882738), ref: 00811C7F
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionH_prologThrowmalloc
                                                • String ID:
                                                • API String ID: 3978722251-0
                                                • Opcode ID: c7d80241c9c698c8dd58f5502bfc0068cf8b68b83b986d911051ed858c2c46cc
                                                • Instruction ID: 283a59eaa60973e128387e35ec85f73a58f39ce79b7eb32e6e3e192679cab5a1
                                                • Opcode Fuzzy Hash: c7d80241c9c698c8dd58f5502bfc0068cf8b68b83b986d911051ed858c2c46cc
                                                • Instruction Fuzzy Hash: EAE01B71614515EFCF0CEF6C98067EDB7A9FF58310F10426DE11AE36D1DBB04A408655
                                                Function 0084A4BF Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084A4C4
                                                  • Part of subcall function 0084A977: __EH_prolog.LIBCMT ref: 0084A97C
                                                  • Part of subcall function 0084A926: __EH_prolog.LIBCMT ref: 0084A92B
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 01fb8c58928f058d3ebb1d432081b70812c35ac54f14529b29860b48374e750e
                                                • Instruction ID: 4bd3bc3f249e7a4c0c62c19523243966bcde8385d303dae419a144fe54620b18
                                                • Opcode Fuzzy Hash: 01fb8c58928f058d3ebb1d432081b70812c35ac54f14529b29860b48374e750e
                                                • Instruction Fuzzy Hash: 4FE0E571900664CADF0CEB5CC4122ECFBA4FB04310F00875DA567E36D1DB745A04C692
                                                Function 0081EA53 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0081EA58
                                                  • Part of subcall function 0081EAF9: __EH_prolog.LIBCMT ref: 0081EAFE
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: b90f184b44cf49551ab18736d4ea8d38c27d300079e28f58b004f652c6ea82d4
                                                • Instruction ID: ef449f3de7040b2d1a0de7bd730e12c03c6df8946a3565a73455f91c05b6f9bc
                                                • Opcode Fuzzy Hash: b90f184b44cf49551ab18736d4ea8d38c27d300079e28f58b004f652c6ea82d4
                                                • Instruction Fuzzy Hash: 35E06570A10620DFC714DFBC940128DB7E4FF08700F00456FE40AD3701DBB495448B55
                                                Function 00835844 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 668ff3596d0889abbe3b9f21a8d63246c7cb4158f901159d8a4129c5675e8aad
                                                • Instruction ID: 07ce6c90d59a44722eb56ce2f5004cf9f7b5afd5b1ac3be80b98b18633039048
                                                • Opcode Fuzzy Hash: 668ff3596d0889abbe3b9f21a8d63246c7cb4158f901159d8a4129c5675e8aad
                                                • Instruction Fuzzy Hash: E8E0E576A04208EFC714EF98D845F9EB7A8FB89754F10845AB40AE7241CB74A900CA64
                                                Function 00816D7D Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00816DA0
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: FileWrite
                                                • String ID:
                                                • API String ID: 3934441357-0
                                                • Opcode ID: 305f53d06b62a4789cfddbba7ee7b3aa6c67ec8ad63c06170b2ef2f9f8e1ffc1
                                                • Instruction ID: e5778ade1d2048708c598786a783e15ef0428670b4037fbad013e404359e734a
                                                • Opcode Fuzzy Hash: 305f53d06b62a4789cfddbba7ee7b3aa6c67ec8ad63c06170b2ef2f9f8e1ffc1
                                                • Instruction Fuzzy Hash: 44E0C275600209EBCB11CF95D805B8E7BB9BB08358F20C069F9199A2A4D335AA60DF90
                                                Function 008221CE Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008221D3
                                                  • Part of subcall function 0082220D: __EH_prolog.LIBCMT ref: 00822212
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 7585dd8ce28f9e0bc6cbdeb2df3f85e9723874514bfe860d8c6d5962a6453c59
                                                • Instruction ID: c5770a88464a40594bcf120ad2d61693d7d4b6a597cb28c1d112188c73bb436c
                                                • Opcode Fuzzy Hash: 7585dd8ce28f9e0bc6cbdeb2df3f85e9723874514bfe860d8c6d5962a6453c59
                                                • Instruction Fuzzy Hash: 63D0C271900204FBD7049B88D802B9EFB78FB40324F00401EF010F1140D3B69A008661
                                                Function 00816C71 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ReadFile.KERNELBASE(000000FF,?,?,00000000,00000000,000000FF,?,008169B3,00000000,00004000,00000000,000000FF,?,?,?), ref: 00816C87
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: FileRead
                                                • String ID:
                                                • API String ID: 2738559852-0
                                                • Opcode ID: a63eb24d3ce0ed844c53441956f9b30fcb95182a32846ce9a9fc28d6f24d4bad
                                                • Instruction ID: 14fad3bb7130ce430dfc8c25ef56c46bf4fe1e567fbdba1d4e7db94b0bae7ea0
                                                • Opcode Fuzzy Hash: a63eb24d3ce0ed844c53441956f9b30fcb95182a32846ce9a9fc28d6f24d4bad
                                                • Instruction Fuzzy Hash: F5E0EC76200208FBCB11CF90CD05FCE7BBABB49754F208058E905971A4C375EA54EB50
                                                Function 00854558 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0085455D
                                                  • Part of subcall function 00811C5F: malloc.MSVCRT ref: 00811C65
                                                  • Part of subcall function 00811C5F: _CxxThrowException.MSVCRT(?,00882738), ref: 00811C7F
                                                  • Part of subcall function 0084D52B: __EH_prolog.LIBCMT ref: 0084D530
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrowmalloc
                                                • String ID:
                                                • API String ID: 3744649731-0
                                                • Opcode ID: 660db91d18bc03232e2a1991aa348b8d0c654e2240d2c3cf06793ece8f400573
                                                • Instruction ID: 115d123da5f94257dce8bcb1306983a15df13cb7fe1cd2603eb5bf4eb4a70130
                                                • Opcode Fuzzy Hash: 660db91d18bc03232e2a1991aa348b8d0c654e2240d2c3cf06793ece8f400573
                                                • Instruction Fuzzy Hash: C4D05E71B40109DFCF0CEBB894463ADB2A1FB44304F10943EE12BE2685EFB0C9448612
                                                Function 00825B2F Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                Download Yara Rule
                                                APIs
                                                • FindCloseChangeNotification.KERNELBASE(00000000,00000000,00825AB8,?,00000000,?,?,00000000,00000000,76778E30), ref: 00825B3D
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ChangeCloseFindNotification
                                                • String ID:
                                                • API String ID: 2591292051-0
                                                • Opcode ID: 80bfa41abda911dc904d4e5bc44055fdf668f56cca48dff7fa71a7417ace3519
                                                • Instruction ID: a34dbe1d58d69b854e02461fb82781a7f708264ca7198184334ad853489a34d1
                                                • Opcode Fuzzy Hash: 80bfa41abda911dc904d4e5bc44055fdf668f56cca48dff7fa71a7417ace3519
                                                • Instruction Fuzzy Hash: 13D0123151462297DB705E2CB8087D573DDBF10336B15445DF880EB244E774CCC35694
                                                Function 00816834 Relevance: 1.5, APIs: 1, Instructions: 16COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • FindCloseChangeNotification.KERNELBASE(00000000,?,00816797,000000FF,00000009,00000001), ref: 0081683F
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ChangeCloseFindNotification
                                                • String ID:
                                                • API String ID: 2591292051-0
                                                • Opcode ID: 6031feff96e2ee22ef2ae8576a9329cc346995934fbbf1459b394d4105b223d9
                                                • Instruction ID: 026b8fd11261dabe58cc14421afafcfd64198c71fa8db151044353908bcc6f25
                                                • Opcode Fuzzy Hash: 6031feff96e2ee22ef2ae8576a9329cc346995934fbbf1459b394d4105b223d9
                                                • Instruction Fuzzy Hash: 00D01231104522868A641F3C78486C133DCBF12334321076DF0F5D31E4E360DCD34694
                                                Function 00815C6D Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                • FindClose.KERNELBASE(00000000,?,00815CA5), ref: 00815C78
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CloseFind
                                                • String ID:
                                                • API String ID: 1863332320-0
                                                • Opcode ID: 2c8658a3d581061c2ee97d92345afeb91bae05673822dd9a5b21611815bfb6c6
                                                • Instruction ID: c4258ac64076a3739348d84a09413540ff345a36b94bc30349ed730cf09fc6d4
                                                • Opcode Fuzzy Hash: 2c8658a3d581061c2ee97d92345afeb91bae05673822dd9a5b21611815bfb6c6
                                                • Instruction Fuzzy Hash: EBD012311056218A8A741E3C7D485C237DCAF523343610759F0B8C31E5D365CCC346D0
                                                Function 00811F50 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID:
                                                • API String ID: 1795875747-0
                                                • Opcode ID: fc16b000a349f4bc9578795a377d4d206aa2088833b2009ae5b613273fdb818b
                                                • Instruction ID: 7eb359c656c8e411bded06dfa73b9137458f83a81385e1a81e933e79f441346b
                                                • Opcode Fuzzy Hash: fc16b000a349f4bc9578795a377d4d206aa2088833b2009ae5b613273fdb818b
                                                • Instruction Fuzzy Hash: 48D0A73610C2009F92445F04F4088CAFBA6FFC8330720441FF444432248F319852CA61
                                                Function 00816D50 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetFileTime.KERNELBASE(?,?,?,?,0082842D,00000000,00000000,00000000), ref: 00816D5E
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: FileTime
                                                • String ID:
                                                • API String ID: 1425588814-0
                                                • Opcode ID: 02c87e56dc2f09c63e2758372df839753c510c5502858f0743cc1f7e482c45f8
                                                • Instruction ID: f51ce69a9815612abd498afab891cc5c8dde2a787af5cf6b493ba633c71fb9d4
                                                • Opcode Fuzzy Hash: 02c87e56dc2f09c63e2758372df839753c510c5502858f0743cc1f7e482c45f8
                                                • Instruction Fuzzy Hash: EAC04C36158106FF8F020FB0CC08C1ABBA2BB95711F10C91CB259C5074D7328064EB02
                                                Function 00816DFC Relevance: 1.5, APIs: 1, Instructions: 6fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetEndOfFile.KERNELBASE(?,00816E41,?,?,?), ref: 00816DFE
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: File
                                                • String ID:
                                                • API String ID: 749574446-0
                                                • Opcode ID: 2eaa7a99ba13383024fc86d7dc05e328a87cc5357b6dbdd9f5f6ec270b136aae
                                                • Instruction ID: 748db9f256c6db39418a6d203b41c9e0233d4ee16a930655584614e1cf8db741
                                                • Opcode Fuzzy Hash: 2eaa7a99ba13383024fc86d7dc05e328a87cc5357b6dbdd9f5f6ec270b136aae
                                                • Instruction Fuzzy Hash: 9DA002702E541BCB8F115F34DC0D8243EA2BB9670B72057ADB007CA5F9DF228458AE52
                                                Function 0085FB76 Relevance: 1.3, APIs: 1, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: malloc
                                                • String ID:
                                                • API String ID: 2803490479-0
                                                • Opcode ID: bba340388013948f7db5caa67d588d6ceeb834de79dd5414dbd10ff6e3088747
                                                • Instruction ID: fd97125911e66ce1cd6b800b6bca5630304a59b314e1909d2f70e3b973ad7b3a
                                                • Opcode Fuzzy Hash: bba340388013948f7db5caa67d588d6ceeb834de79dd5414dbd10ff6e3088747
                                                • Instruction Fuzzy Hash: 5BD0A9B020320186DF884630CC2972A3198BB40223B1884BCEC23CA2AAEB28C01C8396
                                                Function 0085FAD3 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VirtualAlloc.KERNELBASE(00000000), ref: 0085FAE1
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AllocVirtual
                                                • String ID:
                                                • API String ID: 4275171209-0
                                                • Opcode ID: d14c041b9ab558f34f016b03bc6b4d6919239a77e589350bcc02291efa80f5cd
                                                • Instruction ID: 3e35883e0c137d35a142207d0b73effd8eb2e17155097730eea5c90463c7a67c
                                                • Opcode Fuzzy Hash: d14c041b9ab558f34f016b03bc6b4d6919239a77e589350bcc02291efa80f5cd
                                                • Instruction Fuzzy Hash: 88C02BE194D280DFDF0213108C447203F309F83300F0A00C9E4089B0D3C1000C08C733
                                                Function 0085FAA0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: malloc
                                                • String ID:
                                                • API String ID: 2803490479-0
                                                • Opcode ID: 76dc2c96f60cbac892aad4581b4ec10413d41d5e797bb4a4884f54178c200374
                                                • Instruction ID: 28f05d52418ff29dcf8ba92b2e33f709d057c6f91d84c90c590535702790dcc9
                                                • Opcode Fuzzy Hash: 76dc2c96f60cbac892aad4581b4ec10413d41d5e797bb4a4884f54178c200374
                                                • Instruction Fuzzy Hash: 86B01298A0000002EA0903342C080133023B7D050F7C4C8B8AD09C001AFB34C05C6156
                                                Function 0085FA00 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: malloc
                                                • String ID:
                                                • API String ID: 2803490479-0
                                                • Opcode ID: facb3d2eff115836af5cc1d8f3f38fb916d473e421264b725913dcb8fda34ede
                                                • Instruction ID: 4cef3eef584da2c9c6d6d233be500cc777b67952086ba56f74e1f8634f45b985
                                                • Opcode Fuzzy Hash: facb3d2eff115836af5cc1d8f3f38fb916d473e421264b725913dcb8fda34ede
                                                • Instruction Fuzzy Hash: 0BB012A021104002EE1D03347C0C01730047B4010F7C008BCBD0AC0016E725C0585156
                                                Function 0085FB53 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                Download Yara Rule
                                                APIs
                                                • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0085FB5C
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: FreeVirtual
                                                • String ID:
                                                • API String ID: 1263568516-0
                                                • Opcode ID: 83f37894056d2caeb5ac077db1919ee14409624dba148cba2b656e88a233b6df
                                                • Instruction ID: 56fb921dd4d903e9599f32ab910f3dc93527b110322e9843965057703491e08d
                                                • Opcode Fuzzy Hash: 83f37894056d2caeb5ac077db1919ee14409624dba148cba2b656e88a233b6df
                                                • Instruction Fuzzy Hash: 03A00278680B00B6ED6067316D4FF5526347780F41F20868D724DA90D499E4A0C89B5C
                                                Function 0085FAC0 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: free
                                                • String ID:
                                                • API String ID: 1294909896-0
                                                • Opcode ID: cc32ee2ff8957cbb713f2df795d07008ab4f0f4fbd4c8321f866aabe67145d9c
                                                • Instruction ID: 7b5c6efa02ad58bcaebdefb9c2c1652e7983048307956f18cd78766c3e062c13
                                                • Opcode Fuzzy Hash: cc32ee2ff8957cbb713f2df795d07008ab4f0f4fbd4c8321f866aabe67145d9c
                                                • Instruction Fuzzy Hash:
                                                Function 0085FA20 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                Download Yara Rule
                                                APIs
                                                • free.MSVCRT(?,0085C5F9,?,0085CC79,00000000,?,0081D336,?,?,?,?,00000001,?), ref: 0085FA21
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: free
                                                • String ID:
                                                • API String ID: 1294909896-0
                                                • Opcode ID: 4d444db2a5352c34af5dc9f76e669ecc70139be254702ed07da7e57326635bf0
                                                • Instruction ID: 673f88c1baf0bf44c6002a11434136cc3b0ffaf35730a0ebef6202864f27a675
                                                • Opcode Fuzzy Hash: 4d444db2a5352c34af5dc9f76e669ecc70139be254702ed07da7e57326635bf0
                                                • Instruction Fuzzy Hash:
                                                Function 00811C86 Relevance: 1.3, APIs: 1, Instructions: 4COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: free
                                                • String ID:
                                                • API String ID: 1294909896-0
                                                • Opcode ID: ffe3f719d7b457ab993ea5b3c6892801cb7187fdf2cf98d533485164430ddb59
                                                • Instruction ID: c8e583efab45e108c838fb3ec97805075c644738bb02dc03aeac62876842f4ff
                                                • Opcode Fuzzy Hash: ffe3f719d7b457ab993ea5b3c6892801cb7187fdf2cf98d533485164430ddb59
                                                • Instruction Fuzzy Hash: 1DA00271049100DBCB051B10ED0D4497B61FB84612F64846DF44B414758B318860BA11

                                                Non-executed Functions

                                                Function 0082BD97 Relevance: 78.7, APIs: 6, Strings: 38, Instructions: 1704COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082BD9C
                                                  • Part of subcall function 0082B177: __EH_prolog.LIBCMT ref: 0082B17C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: $ $ - $*$:$@$Avg:$Avr:$Benchmark threads: $CPU$CPU hardware threads:$CRC$Compressing$Decompressing$Dict$Dictionary reduced to: $E/U$Effec$KiB/s$LZMA$MIPS$Method$R/U$Rating$Size$Speed$Tot:$Usage$Windows$crc32$file$file size =$freq$freq=$hash$size: $time$usage:
                                                • API String ID: 3519838083-1149398428
                                                • Opcode ID: 9af913500381ee296d21cd52f47c2223b3e2467a77971b84201405b033c2066a
                                                • Instruction ID: 98a83c714a91499881b5dc69f17148ae5414f0c95ee1d31214638fb9c99710ac
                                                • Opcode Fuzzy Hash: 9af913500381ee296d21cd52f47c2223b3e2467a77971b84201405b033c2066a
                                                • Instruction Fuzzy Hash: A1E25C31A002289FDF25DBA8D895BEDBBB5FF45300F1080A9E509AB291DB719EC5CF51
                                                Function 0083BA1C Relevance: 54.2, APIs: 12, Strings: 18, Instructions: 1685COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0083BA21
                                                  • Part of subcall function 00814DCB: __EH_prolog.LIBCMT ref: 00814DD0
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                  • Part of subcall function 00816514: __EH_prolog.LIBCMT ref: 00816519
                                                • _CxxThrowException.MSVCRT(?,00882960), ref: 0083BCDE
                                                • _CxxThrowException.MSVCRT(?,00882960), ref: 0083BD2A
                                                • wcscmp.MSVCRT ref: 0083C4FA
                                                • _CxxThrowException.MSVCRT(?,008871B0), ref: 0083C579
                                                  • Part of subcall function 0083B64F: __EH_prolog.LIBCMT ref: 0083B654
                                                  • Part of subcall function 00815613: __EH_prolog.LIBCMT ref: 00815618
                                                  • Part of subcall function 00815613: DeleteFileW.KERNEL32 ref: 0081565C
                                                • _CxxThrowException.MSVCRT(?,00882960), ref: 0083BD73
                                                  • Part of subcall function 0081150C: __EH_prolog.LIBCMT ref: 00811511
                                                  • Part of subcall function 0082F931: __EH_prolog.LIBCMT ref: 0082F936
                                                  • Part of subcall function 0083B569: __EH_prolog.LIBCMT ref: 0083B56E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow$DeleteFilefreewcscmp
                                                • String ID: 001$7-Zip cannot find MAPISendMail function$D$GetFullPathName error$It is not allowed to include archive to itself$MAPISendMail$Mapi32.dll$SFX file is not specified$Scanning error$The file already exists$The file is read-only$There is some data block after the end of the archive$cannot delete the file$cannot find specified SFX module$cannot load Mapi32.dll$cannot move the file$rsfx$stdout
                                                • API String ID: 924141693-2225666329
                                                • Opcode ID: a23d3872cf052b378e0b2268b82275ea3b096be10b1814dd73e58e8daf594f6b
                                                • Instruction ID: e2789aedcc528a015406a9498771ec7a0dbfe0d7892c6abacd1ad73dbcca33eb
                                                • Opcode Fuzzy Hash: a23d3872cf052b378e0b2268b82275ea3b096be10b1814dd73e58e8daf594f6b
                                                • Instruction Fuzzy Hash: 6CF2AC70801258DEDF25EFA8C885BECBBB4FF54304F1440A9E549B7292DB745E88DB92
                                                Function 00847352 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 173libraryloadertimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(?,?,?,00880C30), ref: 00847368
                                                • GetProcessTimes.KERNEL32(00000000), ref: 0084736F
                                                  • Part of subcall function 00818A69: GetSystemTimeAsFileTime.KERNEL32(00000000,00847388,00000000,00000000,76778E30), ref: 00818A6A
                                                • memset.MSVCRT ref: 00847391
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,00000000,76778E30), ref: 008473AA
                                                • GetProcAddress.KERNEL32(00000000,K32GetProcessMemoryInfo), ref: 008473BF
                                                • LoadLibraryW.KERNEL32(Psapi.dll), ref: 008473CC
                                                • GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 008473DC
                                                • GetCurrentProcess.KERNEL32(?,00000028), ref: 008473EA
                                                • GetProcAddress.KERNEL32(?,QueryProcessCycleTime), ref: 008473FE
                                                • GetCurrentProcess.KERNEL32(?), ref: 0084740A
                                                • fputs.MSVCRT ref: 00847483
                                                • __aulldiv.LIBCMT ref: 00847498
                                                • fputs.MSVCRT ref: 008474B5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Process$AddressCurrentProc$Timefputs$FileHandleLibraryLoadModuleSystemTimes__aulldivmemset
                                                • String ID: F{v$ MCycles$GetProcessMemoryInfo$Global $K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
                                                • API String ID: 2419529047-955597892
                                                • Opcode ID: 79636ddea5da2d306d012f9b549b3d66fadf24c0bae30272dd0105e593f8aba9
                                                • Instruction ID: ad00f372d22c03551c92bd559f43a4ffa2b53ec63f8dce6564912dc175cd3f6d
                                                • Opcode Fuzzy Hash: 79636ddea5da2d306d012f9b549b3d66fadf24c0bae30272dd0105e593f8aba9
                                                • Instruction Fuzzy Hash: 30513E72D04118ABDB50AFE8DC49DAEBBB9FF48704F15802AF605E7294DB7099448F61
                                                Function 00818191 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,771AF5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 008181AD
                                                • GetProcAddress.KERNEL32(00000000), ref: 008181B4
                                                • GetDiskFreeSpaceW.KERNEL32(00000001,00816B24,?,?,?,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 00818204
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressDiskFreeHandleModuleProcSpace
                                                • String ID: GetDiskFreeSpaceExW$kernel32.dll
                                                • API String ID: 1197914913-1127948838
                                                • Opcode ID: 13fd84b8a2a7ccf32cd5bcf1fa9d0395c31f419f0a7d7c60a13b10f8e660619b
                                                • Instruction ID: 79cc1df3b18403a6e6b34f71d103fd2070e6dcf1d203b52eef14c2a1ccd29801
                                                • Opcode Fuzzy Hash: 13fd84b8a2a7ccf32cd5bcf1fa9d0395c31f419f0a7d7c60a13b10f8e660619b
                                                • Instruction Fuzzy Hash: A221F5B2900609EFDB11CF94C885AEEBBF8FF59300F14806AE559E7251E731A945CB60
                                                Function 00855027 Relevance: 7.3, APIs: 3, Instructions: 2834COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0085502C
                                                • SysFreeString.OLEAUT32(?), ref: 008559F0
                                                  • Part of subcall function 0084BC05: __EH_prolog.LIBCMT ref: 0084BC0A
                                                  • Part of subcall function 0084BC05: _CxxThrowException.MSVCRT(?,00882800), ref: 0084BC91
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • SysFreeString.OLEAUT32(?), ref: 00855A95
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: FreeH_prologString$ExceptionThrowfree
                                                • String ID:
                                                • API String ID: 3037006244-0
                                                • Opcode ID: db59721f469747f49c64bbe5e2c9cda211f3c0e828324c2522c40424249313b6
                                                • Instruction ID: 72c2bca15dffb0ec78e66262064c78e64ecd546ae1b746963b9fa9b95b9b3866
                                                • Opcode Fuzzy Hash: db59721f469747f49c64bbe5e2c9cda211f3c0e828324c2522c40424249313b6
                                                • Instruction Fuzzy Hash: F7535930900259DFDF15DBA8C994BEDBBB5FF08305F248099E849E7292DB309E89CB51
                                                Function 00811945 Relevance: 6.3, APIs: 4, Instructions: 253COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0081194A
                                                • GetLastError.KERNEL32(00000000,?,00000001,00000000), ref: 00811973
                                                  • Part of subcall function 00816834: FindCloseChangeNotification.KERNELBASE(00000000,?,00816797,000000FF,00000009,00000001), ref: 0081683F
                                                • GetLastError.KERNEL32(?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 008119FA
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorLast$ChangeCloseFindH_prologNotification
                                                • String ID:
                                                • API String ID: 3746901442-0
                                                • Opcode ID: 3cf082d2b7a80bb4648b8e8e9da92d77e268d60370c0ed80ec02bc41d89ec428
                                                • Instruction ID: e06eedf1ead8cbb5b6d3a8ac4de5fc75cb9bde20a837403a295129e00d153225
                                                • Opcode Fuzzy Hash: 3cf082d2b7a80bb4648b8e8e9da92d77e268d60370c0ed80ec02bc41d89ec428
                                                • Instruction Fuzzy Hash: 3991BC31D05129DECF14EFA8C889AEDBBB9FF14314F144029E652E7251EB304AC6CB91
                                                Function 00818667 Relevance: 4.7, APIs: 3, Instructions: 183timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FileTimeToLocalFileTime.KERNEL32(?,008438D9,00000000,?,?,0084381E,00000000,008438D9, F{v,00000000,00000000), ref: 00818678
                                                • FileTimeToSystemTime.KERNEL32(008438D9,?,?,?,0084381E,00000000,008438D9, F{v,00000000,00000000), ref: 0081868A
                                                • __aullrem.LIBCMT ref: 008187E8
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Time$File$LocalSystem__aullrem
                                                • String ID:
                                                • API String ID: 2417234408-0
                                                • Opcode ID: 96f0b7f8b49144d2912de9254fc2f7f4abe44cf7503d669ebb4e318b9740372d
                                                • Instruction ID: e94b61281b339fb9e6f3893cdc51664d365b75e3348e4f4828c859403ba765e4
                                                • Opcode Fuzzy Hash: 96f0b7f8b49144d2912de9254fc2f7f4abe44cf7503d669ebb4e318b9740372d
                                                • Instruction Fuzzy Hash: E951B572E05255DBD710CF9E84C16EEFBF6EF79210F24845AE888D3282D6764D9AC720
                                                Function 008166A3 Relevance: 4.6, APIs: 3, Instructions: 86COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008166A8
                                                • GetLogicalDriveStringsW.KERNEL32(00000000,00000000,00000050,?,00000000), ref: 008166C5
                                                • GetLogicalDriveStringsW.KERNEL32(00000000,00000000,?,00000000), ref: 008166F3
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: DriveLogicalStrings$H_prologfree
                                                • String ID:
                                                • API String ID: 396970233-0
                                                • Opcode ID: fc664bdc284487bcad0f7f50df9e2bab91744c5d67f0ee8f1fbb0b69d7f1f1bf
                                                • Instruction ID: 260d56b64b7b3127f5a335514a49cdaa03b86ab21e9b43636d18b24a5bd78633
                                                • Opcode Fuzzy Hash: fc664bdc284487bcad0f7f50df9e2bab91744c5d67f0ee8f1fbb0b69d7f1f1bf
                                                • Instruction Fuzzy Hash: 9C21D672E002199BDB10EFF998C56EEF7BCFF44314F10452AE151F3181EA749A848BA1
                                                Function 00852063 Relevance: 3.5, APIs: 2, Instructions: 484COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00852068
                                                  • Part of subcall function 008507AB: _CxxThrowException.MSVCRT(?,00889E28), ref: 008507BE
                                                  • Part of subcall function 00850817: memcpy.MSVCRT ref: 0085083D
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 008524D3
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prologmemcpy
                                                • String ID:
                                                • API String ID: 3273695820-0
                                                • Opcode ID: 3716e146797ffa788019af35764e7018d667ffae622c5afa3d79e77448559fd4
                                                • Instruction ID: 3cb76db7ccc82686e5278a62642ce0fdbef30bc3a6d7cb821a4b4105a369840c
                                                • Opcode Fuzzy Hash: 3716e146797ffa788019af35764e7018d667ffae622c5afa3d79e77448559fd4
                                                • Instruction Fuzzy Hash: D1225B7090024ADFCF14DF68C891AEDBBB1FF19305F148069E859E7252DB70AA99CF91
                                                Function 00872D40 Relevance: 1.9, APIs: 1, Instructions: 356COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: __aulldiv
                                                • String ID:
                                                • API String ID: 3732870572-0
                                                • Opcode ID: 1eee00a7b0e871cc141544ff2730983a3530f19cbad809c1cf8cb7fb23ea7dfe
                                                • Instruction ID: 52f7a36441c51eba57257064fa41bb663f9ea509f4ec4114f3ae971339b1e356
                                                • Opcode Fuzzy Hash: 1eee00a7b0e871cc141544ff2730983a3530f19cbad809c1cf8cb7fb23ea7dfe
                                                • Instruction Fuzzy Hash: 14E14A716043458BCB24CF29C880AAAB7E5FFC8314F14892EF999CB355DB30E945CB92
                                                Function 00860AB0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Version
                                                • String ID:
                                                • API String ID: 1889659487-0
                                                • Opcode ID: bc948334670413bf39d42eb220a1a847c12894692c5947b834573964b844c531
                                                • Instruction ID: 53bab1c44ac1033ee36cf97f69425f45194c1a80a723cc8104894b677cfece0c
                                                • Opcode Fuzzy Hash: bc948334670413bf39d42eb220a1a847c12894692c5947b834573964b844c531
                                                • Instruction Fuzzy Hash: 61E0DF72500249CBD7189B69D805AAF72E4FB94789F89097CE498C1180FB3DD70CCA5A
                                                Function 0081890F Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 008188FC: GetCurrentProcess.KERNEL32(?,?,0081891D), ref: 00818901
                                                  • Part of subcall function 008188FC: GetProcessAffinityMask.KERNEL32(00000000), ref: 00818908
                                                • GetSystemInfo.KERNEL32(?), ref: 00818933
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Process$AffinityCurrentInfoMaskSystem
                                                • String ID:
                                                • API String ID: 3251479945-0
                                                • Opcode ID: f103f73ff7fcc304707994b0597be192a06e860a738af23af33c3df0b9bc31e7
                                                • Instruction ID: ef9b78e92db1d973ca29c6d3317c9a47f9cf23e8e68ebc2a254d995966c55761
                                                • Opcode Fuzzy Hash: f103f73ff7fcc304707994b0597be192a06e860a738af23af33c3df0b9bc31e7
                                                • Instruction Fuzzy Hash: ADD01234E00109D7CF54E7B9D497AEDBB7DBF44308F440068D805E2151DF60D5858652
                                                Function 00818A69 Relevance: 1.5, APIs: 1, Instructions: 3timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSystemTimeAsFileTime.KERNEL32(00000000,00847388,00000000,00000000,76778E30), ref: 00818A6A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Time$FileSystem
                                                • String ID:
                                                • API String ID: 2086374402-0
                                                • Opcode ID: b5b6bf022adadeed81caa40a1d7faec858327c4ebbd1ab4cf29c635f7cc5cd06
                                                • Instruction ID: dd5144724dbc6f99f682c5da83ef522ed8a086f9ec991ab2f48fb9bb9f22b83e
                                                • Opcode Fuzzy Hash: b5b6bf022adadeed81caa40a1d7faec858327c4ebbd1ab4cf29c635f7cc5cd06
                                                • Instruction Fuzzy Hash:
                                                Function 00868F00 Relevance: 1.4, APIs: 1, Instructions: 112COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcpy
                                                • String ID:
                                                • API String ID: 3510742995-0
                                                • Opcode ID: dbbc7af6484a6d9bb8d8fb57ee0007b96d3b8efbe70ec614c8ad2c88a309ae01
                                                • Instruction ID: ff458c1d746ea864896c35868504a0ee2ad33b1f01329f06bed6f531c47c8b17
                                                • Opcode Fuzzy Hash: dbbc7af6484a6d9bb8d8fb57ee0007b96d3b8efbe70ec614c8ad2c88a309ae01
                                                • Instruction Fuzzy Hash: 7841AFB29047068BD704DF18C88067AB3E5FF88318F454A2DF95A97381E731EA15CB82
                                                Function 0086DCB0 Relevance: 1.0, Instructions: 989COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d38d9c3daf1cec3522daaa75679671fafd2c794fb6cbd2d7023c007772a21fe4
                                                • Instruction ID: 5dff3b6d1e8e7032834bc8850e6eadf161c7f6cbf0f4a669209f3656ef6f6980
                                                • Opcode Fuzzy Hash: d38d9c3daf1cec3522daaa75679671fafd2c794fb6cbd2d7023c007772a21fe4
                                                • Instruction Fuzzy Hash: 7E72613164C3188FC398EED9E8C445BF3E1ABC8614F49442DEB9493302E6F4AD599BD6
                                                Function 0086D0F0 Relevance: .7, Instructions: 744COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterEventLeaveObjectSingleWait
                                                • String ID:
                                                • API String ID: 4060455350-0
                                                • Opcode ID: 1e7eb4b30f63870115606b5e31f38afa682c2da46a7c1c004c1714eb9eaafaba
                                                • Instruction ID: 3b9e87d6eb18bcdd183483ddc679785ef11c1db9ca37606893ff839980751a32
                                                • Opcode Fuzzy Hash: 1e7eb4b30f63870115606b5e31f38afa682c2da46a7c1c004c1714eb9eaafaba
                                                • Instruction Fuzzy Hash: 0A62D3B1A083458FCB24DF19C48062ABBE6FFD8744F16896EE899D7315D770E845CB82
                                                Function 0086B000 Relevance: .7, Instructions: 700COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 16382c1a29aef7af5551c62b9eafcfc012b9b6b90b4704257c20ffd99abe1115
                                                • Instruction ID: 0730f304c4673085a81317ff5f29858d9799ec8e4b5a1915dbd0ec8bf6a09d91
                                                • Opcode Fuzzy Hash: 16382c1a29aef7af5551c62b9eafcfc012b9b6b90b4704257c20ffd99abe1115
                                                • Instruction Fuzzy Hash: DC529F71600B058FD328DF29C8957AAB3E1FB84348F454A2DE89BC7791EB74E985CB41
                                                Function 00866936 Relevance: .5, Instructions: 516COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 5e2a2f0d0f42b76f4f6b833c13a8ac4c9f948a915a86b73f9f3c18f8ea78656a
                                                • Instruction ID: 163c168ebb47d72c4377403bb63d17e4dd534e32f98e964c38efa6106375e336
                                                • Opcode Fuzzy Hash: 5e2a2f0d0f42b76f4f6b833c13a8ac4c9f948a915a86b73f9f3c18f8ea78656a
                                                • Instruction Fuzzy Hash: 1F022B73A087554BDB18CE19CC80229B7E3FBD0390F6B462DF89687384EBB09956C795
                                                Function 00867070 Relevance: .5, Instructions: 480COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b5ab2d6071ba4f626031de446fa0850a734d69f202f19f46ab4dd51ed20a1283
                                                • Instruction ID: e9ea221e32e3617362b27f72574ba11a491cd3e4f19d90bf48f45e962dba7df9
                                                • Opcode Fuzzy Hash: b5ab2d6071ba4f626031de446fa0850a734d69f202f19f46ab4dd51ed20a1283
                                                • Instruction Fuzzy Hash: C1022672A0C2158BD709CE28C494239BBE2FBD435CF160A2EE896D7794D774D888CBD5
                                                Function 00869C17 Relevance: .4, Instructions: 412COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 8a35eb23bfbb2e42d9db64dfa6c20342fb6f13a136e6232e037120f984b30622
                                                • Instruction ID: e8570801b6e67749e91dc6cf893de668dcb75e62b1c5f7201f46806c0e1e8022
                                                • Opcode Fuzzy Hash: 8a35eb23bfbb2e42d9db64dfa6c20342fb6f13a136e6232e037120f984b30622
                                                • Instruction Fuzzy Hash: 8E12BE71A082498FD729CF18D490AAEB7E2FFC4308F15896DE88A8B355D735E945CF42
                                                Function 00869C19 Relevance: .4, Instructions: 412COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b2abba081eac47b37eed055b2adf6c06d47b58ab62385bec713e597769fa1dc8
                                                • Instruction ID: 500d03ea7484276b9dabf100639b2e7e8b658bd74b1bd7f768223e6c310f21fd
                                                • Opcode Fuzzy Hash: b2abba081eac47b37eed055b2adf6c06d47b58ab62385bec713e597769fa1dc8
                                                • Instruction Fuzzy Hash: 6812BE719082498FD729CF18C490AAEB7E2FFC4308F15896DE88A8B355D735E945CF42
                                                Function 0086FC30 Relevance: .4, Instructions: 381COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7a5a55e73a073638f721b943c01f760a8cb9e69ff06e7a4e8f8c9e7c2495ef19
                                                • Instruction ID: 68910f2bb29d2d1a0b36703ef8e01490c74c13f52d430fc74343430eb3a2594f
                                                • Opcode Fuzzy Hash: 7a5a55e73a073638f721b943c01f760a8cb9e69ff06e7a4e8f8c9e7c2495ef19
                                                • Instruction Fuzzy Hash: C2F16871604A06DFC358DF28C580AAAF7E1FF88714F11862AEA59C7A55E730F865CF81
                                                Function 00873DF0 Relevance: .3, Instructions: 298COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: c8318f8b2128f83f9e2c9158700333bcd5b67ac502f8a7753f1594d70040e95e
                                                • Instruction ID: 2be7aa190a7873476099724e7429c14c0d5ccec218ed3061788fd7571e5f5347
                                                • Opcode Fuzzy Hash: c8318f8b2128f83f9e2c9158700333bcd5b67ac502f8a7753f1594d70040e95e
                                                • Instruction Fuzzy Hash: DED1E4758487AB4FD354EF5DEC80635B762FB84310F498239DA500B7A7D638BA06E7A0
                                                Function 008742E0 Relevance: .3, Instructions: 297COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 59671ab601704f96d7d1e2f6d5cef7acddb7098f6a04b70d2ab9b6f467f30c7b
                                                • Instruction ID: 87b9483d5ffdd164bec3e3b9cf9622122b69c6fc018566b56aa3162f89d0fb26
                                                • Opcode Fuzzy Hash: 59671ab601704f96d7d1e2f6d5cef7acddb7098f6a04b70d2ab9b6f467f30c7b
                                                • Instruction Fuzzy Hash: 3BD18E36C54B678FE350EF5DDC80235BBA2FB89310F4A4679CA58273A2C634AD11DB90
                                                Function 0085B4C0 Relevance: .2, Instructions: 224COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7db9ed0006fd35939c24c7b2872a1d6ebbe9c20956cabe63342aaa6db62b0eec
                                                • Instruction ID: cc468d27138fcedde97beb939b7bbf09add968343edf68fea9d441f3d1af36f9
                                                • Opcode Fuzzy Hash: 7db9ed0006fd35939c24c7b2872a1d6ebbe9c20956cabe63342aaa6db62b0eec
                                                • Instruction Fuzzy Hash: A7613FB26082118FD708CF69D580E66B3E5FBA8321F1684BED605CB361E731DC49CB58
                                                Function 0086A8C0 Relevance: .2, Instructions: 222COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: dbef4c58f13e3fb2062ecc9ee1b6facaf11625fa49e5bab4642f48e278344108
                                                • Instruction ID: f715ba0fda042f333581e329dbbff038ad907622f3c3d45a17761828a6ffe010
                                                • Opcode Fuzzy Hash: dbef4c58f13e3fb2062ecc9ee1b6facaf11625fa49e5bab4642f48e278344108
                                                • Instruction Fuzzy Hash: 9F81D4B6D4436D8BD750CF88ECC059AB290FB8830CF0A4679CE481B352D778B925DB91
                                                Function 0086ABE0 Relevance: .2, Instructions: 216COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 773eae1fb5a4ab1152b7d61fd545ebf63eff8aedfb9ab69ae84eb9ea8a8482bd
                                                • Instruction ID: a21103b44edb233c1c6fcb24d9df028bad382d98e03b3b8d2a18444a818e0649
                                                • Opcode Fuzzy Hash: 773eae1fb5a4ab1152b7d61fd545ebf63eff8aedfb9ab69ae84eb9ea8a8482bd
                                                • Instruction Fuzzy Hash: 18919072C1872A8BD354CF18D880259B7E0FB98318F05067DEE99A7341D739EA55CBC6
                                                Function 00869F58 Relevance: .2, Instructions: 216COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: dcc2ea395b3f0456f111a30dc183177aa9532a056c4a4fdd8eb7088016df993e
                                                • Instruction ID: b069206b8d68b96fdf7b819407de1474f48d1adf05355cf7f6772ba6370f6a03
                                                • Opcode Fuzzy Hash: dcc2ea395b3f0456f111a30dc183177aa9532a056c4a4fdd8eb7088016df993e
                                                • Instruction Fuzzy Hash: 6DA1C2719082498FD769CF18C490AAEB7F2FF84308F15892DE48A9B351D735E955CF42
                                                Function 00814C7B Relevance: .2, Instructions: 177COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6d94e649d3a926e7f6bb513872d3b8e1f51899a0a72a5ceef8b94be2fab1453d
                                                • Instruction ID: 911df1e64c9a12b5c995c40b613334ae2718318743cb2c258cd117a7deb85d01
                                                • Opcode Fuzzy Hash: 6d94e649d3a926e7f6bb513872d3b8e1f51899a0a72a5ceef8b94be2fab1453d
                                                • Instruction Fuzzy Hash: DD5191B3E204354AE79CCE24DC217767692F788310F4BC5B99D8BAB2E5CDB8985187C0
                                                Function 00861050 Relevance: .2, Instructions: 167COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7b14259b363909f47c08b5e9c2d2292d0a1b7bd35c401dd425e102265623d2aa
                                                • Instruction ID: 0fa0f8ff0890eb29009dde00145cf107e28ac168ee6f862a0c08db8032bf103b
                                                • Opcode Fuzzy Hash: 7b14259b363909f47c08b5e9c2d2292d0a1b7bd35c401dd425e102265623d2aa
                                                • Instruction Fuzzy Hash: B1517E75B00B488FCB24CE18C58462AB7E2FB8A304F194A2ED697C7B42DB71F845CB40
                                                Function 00860610 Relevance: .1, Instructions: 143COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b31d452cf4fc038398579975b7917bb1ff375609163340ad82824380036c8528
                                                • Instruction ID: b8820b86cb168a6b9b603fd28887c599c5b00223ba34629398d18ce03cbd6dd7
                                                • Opcode Fuzzy Hash: b31d452cf4fc038398579975b7917bb1ff375609163340ad82824380036c8528
                                                • Instruction Fuzzy Hash: 10417633A0432A8BC7158E2C889017BF791FBE1314F0B876DC996CB282D2219D58CFD9
                                                Function 0085F150 Relevance: .1, Instructions: 141COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e44a4b31253bfdf949f2f46c53ab0923a32f4f7d0d009f144b1d26916e7be97a
                                                • Instruction ID: 6882d396762d02480e71032a714cc24e2ab46a0895fbc4777cdbc320e6cd7d52
                                                • Opcode Fuzzy Hash: e44a4b31253bfdf949f2f46c53ab0923a32f4f7d0d009f144b1d26916e7be97a
                                                • Instruction Fuzzy Hash: 0041D671B10A204AB30CCF7A9C851666FC3E7C9386B44C23DD569C66ECDABDC41B8760
                                                Function 0082E1C2 Relevance: .1, Instructions: 136COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                                                • Instruction ID: 0342a0ac70707e1fb959f754e427688d09e1578dd9fb4cb9831e9fb89937cc5e
                                                • Opcode Fuzzy Hash: 72c1d2a683874879174d131ccb4dddd1e2f70cb764b1e7878fe2ff4eea78678e
                                                • Instruction Fuzzy Hash: C53114277A041143CB1CCD7BDC067AFA153ABE422670ECF396D5ACEF55D56CC8625108
                                                Function 00811553 Relevance: .1, Instructions: 97COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: cb774df3a01de39c65582a6185cd531f130fdad3d4153e888f67e0f50f4c92e6
                                                • Instruction ID: 62da2fa65041418948872e9118a8e2d888ce43aa88b3065b10d909f59bb2ca21
                                                • Opcode Fuzzy Hash: cb774df3a01de39c65582a6185cd531f130fdad3d4153e888f67e0f50f4c92e6
                                                • Instruction Fuzzy Hash: 91314F76A619164BE70CCB28EC33BB92681F784305F49527EEA4BCB3D1DB6C8C50C649
                                                Function 00873C30 Relevance: .1, Instructions: 95COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: fa3440e3555bae768f333d70954a9e9bc6dfd4772c2e60db56666415c24709ef
                                                • Instruction ID: d07539761e6caa3fc7bcc90ee3ed91e1e546f1d08d31b3ed5a81990f8d4bf9f1
                                                • Opcode Fuzzy Hash: fa3440e3555bae768f333d70954a9e9bc6dfd4772c2e60db56666415c24709ef
                                                • Instruction Fuzzy Hash: BC312BB2B087B607E3209E1E8C50125BB93FFC1611F18C379E4A98B74BD575E58397A1
                                                Function 00875623 Relevance: .1, Instructions: 92COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                • Instruction ID: 1978120ba80502eb1abbf044933a5b18a08600c28e705644bf121556ebc982af
                                                • Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                • Instruction Fuzzy Hash: A641A351814F9653EB124F7CC882262B320BFAB244F00D75AFDD1B9963FB72A5446651
                                                Function 00875971 Relevance: .1, Instructions: 72COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 86d22ac803694251da3d5663bdc7c2053185f9a951a5658cb00391f05c9a66c7
                                                • Instruction ID: 263962bdec030cc03efb8d70f7ac383382d8a6798043c3220af3a7f43d6f1ff3
                                                • Opcode Fuzzy Hash: 86d22ac803694251da3d5663bdc7c2053185f9a951a5658cb00391f05c9a66c7
                                                • Instruction Fuzzy Hash: F92127326015288FC741EF6AD88469BB3E2FFC8365F67C63DDD8587245C670E9068650
                                                Function 008757B1 Relevance: .1, Instructions: 70COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                • Instruction ID: 7d75673f4e236702aff3748582b5b54b5b0937242b589bcdc4ac1a8234b616e0
                                                • Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                • Instruction Fuzzy Hash: C221F832D00A258BC741CE6EE4845A7F391FFC4369F178636DD98A7191C534E814C6D0
                                                Function 0087588B Relevance: .1, Instructions: 70COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                • Instruction ID: 1f3577e64790f730099ba24980e850c92f46a4ad6c0b83a46aba5d5caf7d7bb6
                                                • Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                • Instruction Fuzzy Hash: 312122729109258BC301DF2DF488B77B3E1FFD4329F638A3AD99A8B184C634D804D6A0
                                                Function 00860F40 Relevance: .1, Instructions: 68COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6218bc90c9121070e7ea681b917aae75b2d4c0b4172c8a51d81b5e8232a49ff0
                                                • Instruction ID: c22ca300080e3810b37858fa09f5c91dcced6548f277b1c2c3bc9ae9794501db
                                                • Opcode Fuzzy Hash: 6218bc90c9121070e7ea681b917aae75b2d4c0b4172c8a51d81b5e8232a49ff0
                                                • Instruction Fuzzy Hash: 5411427B3A0D0A47EB4C853CDC337A921C09745309B98623DE25BCE3C2EB6EC846C649
                                                Function 0086EC30 Relevance: .0, Instructions: 48COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: dfb71419cd14e22614a1567b1ae8a258332b25976960fdbe4a148c08b303a472
                                                • Instruction ID: 088998d87bbf6dad54d0d1f08058f77aac61b75ebc6629a47837dadbbdaf8245
                                                • Opcode Fuzzy Hash: dfb71419cd14e22614a1567b1ae8a258332b25976960fdbe4a148c08b303a472
                                                • Instruction Fuzzy Hash: C801EC696A668989DB81DA7DD890748FE80F756302F9CC3E4E0C8CBF42D589C54AC3A1
                                                Function 00868E80 Relevance: .0, Instructions: 41COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                                                • Instruction ID: 32110a318834e776e4ab436db90f3e61cd74d3df0df7c5195a2b4a84037ca668
                                                • Opcode Fuzzy Hash: b8de0586c271a62662545cbcc3a7a3f305336ecaaee466a7150af84251bbb2fa
                                                • Instruction Fuzzy Hash: D001AD7291462E57DB289F08CC41136B390FB84312F49823ADD469B385E634F870C6C4
                                                Function 008179F9 Relevance: .0, Instructions: 20COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 3e9d477d0c730015725f038db247b44b206ccbdf08a4713c4ec9a3145f2a572e
                                                • Instruction ID: e7e4966205a175e5882e71313f6af8a1fd9133fd4de119a51c7f7e4c3536fc6b
                                                • Opcode Fuzzy Hash: 3e9d477d0c730015725f038db247b44b206ccbdf08a4713c4ec9a3145f2a572e
                                                • Instruction Fuzzy Hash: 77D05E2955C23015DE34A21A8000BEF87EDEFE3734F05986FE05CD3141C5748AC78AA2
                                                Function 00851231 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 452COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00851236
                                                  • Part of subcall function 00850982: _CxxThrowException.MSVCRT(?,00889E68), ref: 008509A5
                                                • memcpy.MSVCRT ref: 00851628
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 008516C4
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 008516D8
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 008516EC
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851700
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851714
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851728
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 0085173C
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851750
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851764
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00851778
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 0085178C
                                                  • Part of subcall function 008507AB: _CxxThrowException.MSVCRT(?,00889E28), ref: 008507BE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prologmemcpy
                                                • String ID: $!$@
                                                • API String ID: 3273695820-2517134481
                                                • Opcode ID: 9035ebe2e5f6c51670ed334c2371c85dfcf8e6b46fdac23bef6dd107443ca0c4
                                                • Instruction ID: 5f226073af3f79f1b51e5b6ef0f8be68708f9b239d828880957b5b788aa03e3e
                                                • Opcode Fuzzy Hash: 9035ebe2e5f6c51670ed334c2371c85dfcf8e6b46fdac23bef6dd107443ca0c4
                                                • Instruction Fuzzy Hash: E7126974A01249EFCF14DFA8C484AEDBBB1FF49302F148059E856EB752DB30A989CB55
                                                Function 00847075 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 179COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084707A
                                                • fputs.MSVCRT ref: 008470E4
                                                  • Part of subcall function 008120E7: fputs.MSVCRT ref: 00812101
                                                • fputs.MSVCRT ref: 008470B5
                                                  • Part of subcall function 008472A7: __EH_prolog.LIBCMT ref: 008472AC
                                                  • Part of subcall function 008472A7: fputs.MSVCRT ref: 008472D5
                                                  • Part of subcall function 008472A7: fputs.MSVCRT ref: 00847319
                                                • fputs.MSVCRT ref: 00847167
                                                • fputs.MSVCRT ref: 00847186
                                                • fputs.MSVCRT ref: 008471AF
                                                • fputs.MSVCRT ref: 008471C2
                                                • fputc.MSVCRT ref: 008471CF
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prologfputc
                                                • String ID: Error:$ F{v$ file$@F{v$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
                                                • API String ID: 3294964263-2673675069
                                                • Opcode ID: a6d1ca63e2955da99661a0c5ee58bf903827767968543ea09b179d293c8b3fbf
                                                • Instruction ID: 201fb117160946dc413978bdd8bfa9e0f11cd7ec1246ea20669ec715b5b80974
                                                • Opcode Fuzzy Hash: a6d1ca63e2955da99661a0c5ee58bf903827767968543ea09b179d293c8b3fbf
                                                • Instruction Fuzzy Hash: 2B51D631A041199BCF19EF98D886AEDB7B5FF44300F20006EF506E6692DF755E84CB62
                                                Function 00824DD0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 166COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00824DD5
                                                • OpenFileMappingW.KERNEL32(00000004,00000000,?,?,?,00000000,?), ref: 00824E99
                                                • GetLastError.KERNEL32(?,00000000,?), ref: 00824EA6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorFileH_prologLastMappingOpen
                                                • String ID: Can not open mapping$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
                                                • API String ID: 2221086200-220075109
                                                • Opcode ID: e5625af35435e592d672b3b875e7ac076670c98417b5708f43cae3bf39715dc0
                                                • Instruction ID: 40d5bab02df5ecfc76d19dffed48e656205b290072cdff3c0cab8b789b8f435a
                                                • Opcode Fuzzy Hash: e5625af35435e592d672b3b875e7ac076670c98417b5708f43cae3bf39715dc0
                                                • Instruction Fuzzy Hash: 2F51AB7580022ADECF10EBA8EA84AEDB7B4FF58314F115159E905F7251DB709E84CBA2
                                                Function 00841723 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00841728
                                                • fputs.MSVCRT ref: 00841745
                                                • fputs.MSVCRT ref: 0084174E
                                                  • Part of subcall function 00812029: __EH_prolog.LIBCMT ref: 0081202E
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                • fputs.MSVCRT ref: 00841794
                                                • fputs.MSVCRT ref: 0084179D
                                                • fputs.MSVCRT ref: 008417A4
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • fputs.MSVCRT ref: 008417D6
                                                • fputs.MSVCRT ref: 008417DF
                                                • fputs.MSVCRT ref: 008417E7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog$fputcfree
                                                • String ID: Modified: $Path: $Size:
                                                • API String ID: 2632947726-3207571042
                                                • Opcode ID: cf4c5e3ab3a73ea630c04d96ff0791133a83a1a20da8669d10dfb44a84f0c009
                                                • Instruction ID: e436fb063e09e6d9b5e4f754ca7d681e5516d4f3a210d5b8f05e8b06f483092d
                                                • Opcode Fuzzy Hash: cf4c5e3ab3a73ea630c04d96ff0791133a83a1a20da8669d10dfb44a84f0c009
                                                • Instruction Fuzzy Hash: F421B630A00119EBCF05AB99DCC9DAE7F26FF44350F144056F918DA2A6EF3188A5DF92
                                                Function 00819F41 Relevance: 20.3, APIs: 16, Instructions: 267COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 36cb01f2a273cc5e5838b01b5f31bdef06b94a60c11f93371596cd21fbe23573
                                                • Instruction ID: 5bf36c5fbf3183f032eec5b6ec4814fb1af244d0fdf42bc8a08b03b5490908a8
                                                • Opcode Fuzzy Hash: 36cb01f2a273cc5e5838b01b5f31bdef06b94a60c11f93371596cd21fbe23573
                                                • Instruction Fuzzy Hash: 7F814771600A15ABD7249E25DC41EA733ACFF65B04F004428FC9AE7285EB75FE85CB92
                                                Function 00843298 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 323COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: F{v$@$data:
                                                • API String ID: 2614055831-1933137613
                                                • Opcode ID: 3a6939b4423591fa9e52b721961a6a41cb325f1b8137ee14f3b2d66705495a08
                                                • Instruction ID: e71fd1014617757fb9d6b2e7fc4634b6a551f7f1dd97468df9fdaac7c939e46f
                                                • Opcode Fuzzy Hash: 3a6939b4423591fa9e52b721961a6a41cb325f1b8137ee14f3b2d66705495a08
                                                • Instruction Fuzzy Hash: BAC1BD7190020EEFCF15DFA8D884AEEB7B5FF58314F244529E146E3291EB30AA44DB61
                                                Function 0084757A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$fputc$__aulldiv
                                                • String ID: F{v$ Time =$Kernel
                                                • API String ID: 3602660170-1313714572
                                                • Opcode ID: 2c4b49d55fc7d7a2e91ea88df6ad20141e9c6b23c08b64c3b74142eec3de4e4d
                                                • Instruction ID: a1434d9e374e37dbdb34967771f8be31c3569af544593609942bc4ea6fba313f
                                                • Opcode Fuzzy Hash: 2c4b49d55fc7d7a2e91ea88df6ad20141e9c6b23c08b64c3b74142eec3de4e4d
                                                • Instruction Fuzzy Hash: 7C315032600618BFEB15AF98DC46B9A77A5FF48710F11842AF908DB2D0D7B1ED508FA5
                                                Function 0084769E Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: $ F{v$ MB$ Memory =
                                                • API String ID: 2614055831-2899367966
                                                • Opcode ID: 203ebd5491fa37354c38fa2b29cfbb66f72a07d827a083492a50f3423c12b4bb
                                                • Instruction ID: 03d07a281eabacee51213373541a5a8ea18ffc783c999038cd03abb48f1b9bd6
                                                • Opcode Fuzzy Hash: 203ebd5491fa37354c38fa2b29cfbb66f72a07d827a083492a50f3423c12b4bb
                                                • Instruction Fuzzy Hash: 2F11A332A00109AFDB15AB98EC42EADBB75FF84310F108027F604D62D5EB759895DFA2
                                                Function 0084E01E Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 364COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084E023
                                                  • Part of subcall function 0081851A: VariantClear.OLEAUT32(?), ref: 00818542
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ClearH_prologVariant
                                                • String ID: $ $.$:mem$Delta$LZMA$LZMA2$o
                                                • API String ID: 1166855276-3806607069
                                                • Opcode ID: 10c4b9000f3cdcbe4b5735e410cde14ba0c1d65e3f1806a0a480a580c950ff34
                                                • Instruction ID: de18c3233712bf56d3f68d842d8382f3db45dff899b28731da40ef95fe05a11d
                                                • Opcode Fuzzy Hash: 10c4b9000f3cdcbe4b5735e410cde14ba0c1d65e3f1806a0a480a580c950ff34
                                                • Instruction Fuzzy Hash: B0D10031A0025D8BCF21CFA8C8847EDBBB2FF55304F24456AD896EB286C7719E49CB51
                                                Function 0085F500 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84libraryloaderthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcessId.KERNEL32(?,0088C870), ref: 0085F51A
                                                  • Part of subcall function 0086E790: memcpy.MSVCRT ref: 0086E7C4
                                                • GetCurrentThreadId.KERNEL32 ref: 0085F533
                                                  • Part of subcall function 0086E790: memcpy.MSVCRT ref: 0086E7DD
                                                  • Part of subcall function 0086E790: memcpy.MSVCRT ref: 0086E82C
                                                • LoadLibraryW.KERNEL32(Advapi32.dll,00000004,?,0088C870), ref: 0085F551
                                                • GetProcAddress.KERNEL32(00000000,SystemFunction036), ref: 0085F563
                                                • FreeLibrary.KERNEL32(00000000,?,0088C870), ref: 0085F595
                                                • QueryPerformanceCounter.KERNEL32(?,?,0088C870), ref: 0085F5A6
                                                • GetTickCount.KERNEL32 ref: 0085F5BF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcpy$CurrentLibrary$AddressCountCounterFreeLoadPerformanceProcProcessQueryThreadTick
                                                • String ID: Advapi32.dll$SystemFunction036
                                                • API String ID: 3940253874-4153481884
                                                • Opcode ID: 15d17d14b94c1b648ceb628058ae491a674e3a3f7b16b19137da3663e6517612
                                                • Instruction ID: ac18ffc10497ec32536145cbcf5ec101fcfe21feebd952f16d344210ce588164
                                                • Opcode Fuzzy Hash: 15d17d14b94c1b648ceb628058ae491a674e3a3f7b16b19137da3663e6517612
                                                • Instruction Fuzzy Hash: F4318D356043068BD310EF24E889B6A77A5FF84704F40492CFA89D7196FA74DA4DCBA3
                                                Function 0084406B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 37COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
                                                • API String ID: 1795875747-2741933734
                                                • Opcode ID: 42210c8a08b43ee8687a84333e495b5c024afdebc0c17b5feac8c885c75921a8
                                                • Instruction ID: 7a45496a10bac14ccbb264f8b4da7c28342cab564509a6cad3c50f0471076192
                                                • Opcode Fuzzy Hash: 42210c8a08b43ee8687a84333e495b5c024afdebc0c17b5feac8c885c75921a8
                                                • Instruction Fuzzy Hash: FFF0E2326042187B9610269AAC94D2EFF4DFF853B4B14406BFB08C3252AA2298608FA1
                                                Function 008159C1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 008159CF
                                                • GetTickCount.KERNEL32 ref: 008159DA
                                                • GetCurrentProcessId.KERNEL32 ref: 008159E5
                                                • GetTickCount.KERNEL32 ref: 00815A44
                                                • SetLastError.KERNEL32(000000B7,?), ref: 00815A77
                                                • GetLastError.KERNEL32(?), ref: 00815A9D
                                                  • Part of subcall function 00815305: __EH_prolog.LIBCMT ref: 0081530A
                                                  • Part of subcall function 00815305: CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,00000001), ref: 0081532C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CountCurrentErrorLastTick$CreateDirectoryH_prologProcessThread
                                                • String ID: .tmp$d
                                                • API String ID: 43677640-2797371523
                                                • Opcode ID: 8b46eb3a2552dad9e1d58ca965f3b8d05ae73dc8ce0809db02ee97764ca4f6c4
                                                • Instruction ID: 22668793a75fdde609aef0e631fdd9bcb7d7cdaae94fb0fa768fad3008ca3ecf
                                                • Opcode Fuzzy Hash: 8b46eb3a2552dad9e1d58ca965f3b8d05ae73dc8ce0809db02ee97764ca4f6c4
                                                • Instruction Fuzzy Hash: D8312432A80628DBDB14ABA4D4897EC3769FFD1315F144229E846DB281D7348CC0CB92
                                                Function 008415AA Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                • Would you like to replace the existing file:, xrefs: 008415FE
                                                • with the file from archive:, xrefs: 00841623
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                • String ID: Would you like to replace the existing file:$with the file from archive:
                                                • API String ID: 3914623533-686978020
                                                • Opcode ID: 953ac7595db7b5b7d59930db2172b797519b6489ecbfad671cbe9d062fd839fc
                                                • Instruction ID: 5815640e2da100543159401e54048f16f42fd3bf72c26c22b9be48baf7cbbb16
                                                • Opcode Fuzzy Hash: 953ac7595db7b5b7d59930db2172b797519b6489ecbfad671cbe9d062fd839fc
                                                • Instruction Fuzzy Hash: F331A875200208DBDF11AF58D849BEAB7A1FF48314F264519EA1AD7251CB70EC80CFA6
                                                Function 00815DD4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 00815DFA
                                                • GetProcAddress.KERNEL32(00000000), ref: 00815E03
                                                • GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 00815E10
                                                • GetProcAddress.KERNEL32(00000000), ref: 00815E13
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressHandleModuleProc
                                                • String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
                                                • API String ID: 1646373207-4044117955
                                                • Opcode ID: a62714726a93c751b16b6fd2b334df1dd65adb6f28be131b7584c95b5d98004c
                                                • Instruction ID: a432cad971ced10233fcd6f73a7faac92f11569c50e7000aec639c324252dc86
                                                • Opcode Fuzzy Hash: a62714726a93c751b16b6fd2b334df1dd65adb6f28be131b7584c95b5d98004c
                                                • Instruction Fuzzy Hash: E0E0487164121CA79A00A7EEBC48C66BB5CFB95715311447FF105D3329D6B5B8418B70
                                                Function 0083F0A0 Relevance: 11.4, APIs: 9, Instructions: 116COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 06205d5fe39b29ef6061a131a0e5c732353d5972d9a8fdc777a7daac25b4defe
                                                • Instruction ID: 076fec66bcb0dc92a66c3902d811ffbf4187240c2cdb91614036a10b287af0fa
                                                • Opcode Fuzzy Hash: 06205d5fe39b29ef6061a131a0e5c732353d5972d9a8fdc777a7daac25b4defe
                                                • Instruction Fuzzy Hash: 2A315D72B00609EBDB059A24DC82E7E33A8FBA0794F008435FD0ADA287F765ED4497D1
                                                Function 0081125E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 134COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
                                                • API String ID: 3519838083-2104980125
                                                • Opcode ID: 0304d4d2eb66aa8a4a89709893dc9db35d37e2871229835a97da9c2e12769f33
                                                • Instruction ID: 1b3912988ea704734c9369e957d5379307e20216e020490d709088543aa481a1
                                                • Opcode Fuzzy Hash: 0304d4d2eb66aa8a4a89709893dc9db35d37e2871229835a97da9c2e12769f33
                                                • Instruction Fuzzy Hash: D951C030A0424ACFCF14CF58C488AEEBBB9FF01314F14815AD565DBA9AD774EA81CB91
                                                Function 00824AC9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00824ACE
                                                  • Part of subcall function 00816514: __EH_prolog.LIBCMT ref: 00816519
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00824B12
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00824B93
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00824BB0
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 00824BD7
                                                  • Part of subcall function 00830F43: __EH_prolog.LIBCMT ref: 00830F48
                                                Strings
                                                • The file operation error for listfile, xrefs: 00824B40
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prolog
                                                • String ID: The file operation error for listfile
                                                • API String ID: 206451386-4247703111
                                                • Opcode ID: 50ccf8f9fea65c7777943b36eddc64b7bf42c92fe2863e7ecf26125301243941
                                                • Instruction ID: 2d3666dd13ccdad74387f91c4c2ef1542e2e9ec0941a59df7707db688728612c
                                                • Opcode Fuzzy Hash: 50ccf8f9fea65c7777943b36eddc64b7bf42c92fe2863e7ecf26125301243941
                                                • Instruction Fuzzy Hash: BB419D71901119ABCF11EFD8E9829EEBBB9FF58710F105019F815F3252DB709A85CBA2
                                                Function 00841B76 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                • String ID: :
                                                • API String ID: 3914623533-3653984579
                                                • Opcode ID: 01d6300832a81bdd86db293449592dfc7816e2e91d5e73ecaaeb4439b8330afe
                                                • Instruction ID: 32ca1bbdcc514a87e0aa3360744ea36da40dddf9c12f44365fe0155e583bf3b5
                                                • Opcode Fuzzy Hash: 01d6300832a81bdd86db293449592dfc7816e2e91d5e73ecaaeb4439b8330afe
                                                • Instruction Fuzzy Hash: 74316E71901609CFDB14EF68D888EDAB7B4FF44314F10856EE51AD7252C734A985CF61
                                                Function 00841F4C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfputs
                                                • String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
                                                • API String ID: 1798449854-3393983761
                                                • Opcode ID: 3828048f53a06a896113ee68ab4c2181b5eeaf1ae76199125145ee1514429b13
                                                • Instruction ID: 947d2d47e700b20c2d37b1f08eec9fdc3c47b568ce8415bf2057d3e88eb51e64
                                                • Opcode Fuzzy Hash: 3828048f53a06a896113ee68ab4c2181b5eeaf1ae76199125145ee1514429b13
                                                • Instruction Fuzzy Hash: 2B217431600509DBCF14EBA8C4469EDB7A4FF58314F004129E60AD7756DF30EC9A8B82
                                                Function 0084965D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                Download Yara Rule
                                                APIs
                                                • fputs.MSVCRT ref: 00849678
                                                  • Part of subcall function 00811E68: fflush.MSVCRT ref: 00811E6A
                                                • GetStdHandle.KERNEL32(000000F6), ref: 0084968A
                                                • GetConsoleMode.KERNEL32(00000000,00000000), ref: 008496AC
                                                • SetConsoleMode.KERNEL32(00000000,00000000), ref: 008496BD
                                                • SetConsoleMode.KERNEL32(00000000,00000000), ref: 008496DD
                                                Strings
                                                • Enter password (will not be echoed):, xrefs: 00849673
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ConsoleMode$Handlefflushfputs
                                                • String ID: Enter password (will not be echoed):
                                                • API String ID: 108775803-3720017889
                                                • Opcode ID: f3afe433c56d5351133630d6e887c75750e7f5936db000364d2a46bde33dc4df
                                                • Instruction ID: 2c609c86f7c726f9d78a05c8368862ab1539b9fc0a871b38feff34438a6b1259
                                                • Opcode Fuzzy Hash: f3afe433c56d5351133630d6e887c75750e7f5936db000364d2a46bde33dc4df
                                                • Instruction Fuzzy Hash: CA11E732900218ABCF11ABA89C49AEFBBBCFF85720F154159E850E31A4CB304D85CB61
                                                Function 0084597D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: Decoding ERROR$ F{v$@F{v$S_$u
                                                • API String ID: 1795875747-3065656227
                                                • Opcode ID: c0f768c20a98043f623f8c4aed86b64adeaf66b5d8022a97cf06a31d243aecfb
                                                • Instruction ID: a69cda1afd350d69ceafc567bb4c7d0db4e8178348d0d5241abe7c1ded773c90
                                                • Opcode Fuzzy Hash: c0f768c20a98043f623f8c4aed86b64adeaf66b5d8022a97cf06a31d243aecfb
                                                • Instruction Fuzzy Hash: 2F215830A0415CDBCF25EB98D989BDCBBB0FF15304F5481A9E049E72A2DB345A84CF12
                                                Function 00873BD0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetVersionExW.KERNEL32 ref: 00873BEA
                                                • GetVersionExW.KERNEL32(?), ref: 00873BF1
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00873C11
                                                • GetProcAddress.KERNEL32(00000000), ref: 00873C18
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: Version$AddressHandleModuleProc
                                                • String ID: SetDefaultDllDirectories$kernel32.dll
                                                • API String ID: 2268189529-2102062458
                                                • Opcode ID: a75443a66c06b6b573a8a0bb4d2bc437460c8be99c7e9c8124d9b6bdfc964735
                                                • Instruction ID: 2cd38930197a5214d6604655ba42cf847c0a7163749d3491e9180b7b4826f23a
                                                • Opcode Fuzzy Hash: a75443a66c06b6b573a8a0bb4d2bc437460c8be99c7e9c8124d9b6bdfc964735
                                                • Instruction Fuzzy Hash: 54F08C31504301EBE614ABA4DC0AEAA7B98FB84B00F04C42DA528E2198D638C684DBB3
                                                Function 00850CD2 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 226COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00850982: _CxxThrowException.MSVCRT(?,00889E68), ref: 008509A5
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00850CFF
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00850E5B
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00850E6F
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00850EB0
                                                • _CxxThrowException.MSVCRT(?,00889E68), ref: 00850F18
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$free
                                                • String ID:
                                                • API String ID: 3129652135-3916222277
                                                • Opcode ID: 536360330d6e69fe2178b2210351fc1cd3d8bf1e5fc97f995ac60f5c4b4d8114
                                                • Instruction ID: a8d8fee0378ae2209a3134cd420012f69669fd9ab6b0fbdee1f6894b396e4c92
                                                • Opcode Fuzzy Hash: 536360330d6e69fe2178b2210351fc1cd3d8bf1e5fc97f995ac60f5c4b4d8114
                                                • Instruction Fuzzy Hash: 2D916C75E002199BCF10EFA8C4915ADBBB5FF48311F14845AEC65EB346C774AA88CFA1
                                                Function 00815EA3 Relevance: 9.1, APIs: 6, Instructions: 74COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00815EA8
                                                  • Part of subcall function 00815C6D: FindClose.KERNELBASE(00000000,?,00815CA5), ref: 00815C78
                                                • SetLastError.KERNEL32(00000078,00000000,?,?), ref: 00815ED1
                                                • SetLastError.KERNEL32(00000000,00000000,?,?), ref: 00815EDD
                                                • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 00815EFE
                                                • GetLastError.KERNEL32(?,?), ref: 00815F0B
                                                • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 00815F47
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorFindLast$FirstStream$CloseH_prolog
                                                • String ID:
                                                • API String ID: 1050961465-0
                                                • Opcode ID: 234fd418f071ea2bd3da2c108c009800a3d4662dc7ec886313c49b0f7c674b90
                                                • Instruction ID: 42d3795708e1ccf7d52158442a2aa3ed8c9947367dfd41959cf9fc0ae7a4e318
                                                • Opcode Fuzzy Hash: 234fd418f071ea2bd3da2c108c009800a3d4662dc7ec886313c49b0f7c674b90
                                                • Instruction Fuzzy Hash: A821AF30800A05EFCB20EF64E8898FEBB79FF81760F144269E455D2190CB3159C6DB61
                                                Function 008484B2 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMON
                                                Download Yara Rule
                                                APIs
                                                • fputs.MSVCRT ref: 0084856D
                                                  • Part of subcall function 00848093: fputs.MSVCRT ref: 008480FC
                                                • fputs.MSVCRT ref: 008486EE
                                                  • Part of subcall function 00811E68: fflush.MSVCRT ref: 00811E6A
                                                • fputs.MSVCRT ref: 00848620
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prologfflushfputc
                                                • String ID: ERRORS:$WARNINGS:
                                                • API String ID: 1876658717-3472301450
                                                • Opcode ID: efdf0b674de563b7051d9554aa2798561fff2f0eb8ce22cf7e61e8b0b3b5e468
                                                • Instruction ID: 4be5040c5da064cd37d32064833d9c1d07607d1f158791daa2c219efa165278b
                                                • Opcode Fuzzy Hash: efdf0b674de563b7051d9554aa2798561fff2f0eb8ce22cf7e61e8b0b3b5e468
                                                • Instruction Fuzzy Hash: B3716E30600709DBEF64EFA9C499BAEB7A6FF44300F15842DE95AD7651CF30A881CB52
                                                Function 00816A6D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157COMMON
                                                Download Yara Rule
                                                APIs
                                                • DeviceIoControl.KERNEL32(00000000,00074004,00000000,00000000,?,00000020,?,00000000), ref: 00816AB7
                                                • DeviceIoControl.KERNEL32(000000FF,000700A0,00000000,00000000,?,00000028,?,00000000), ref: 00816B5A
                                                • DeviceIoControl.KERNEL32(000000FF,00070000,00000000,00000000,00000003,00000018,?,00000000), ref: 00816B8A
                                                • DeviceIoControl.KERNEL32(000000FF,0002404C,00000000,00000000,00000003,00000018,?,00000000), ref: 00816BAC
                                                  • Part of subcall function 00818191: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,771AF5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 008181AD
                                                  • Part of subcall function 00818191: GetProcAddress.KERNEL32(00000000), ref: 008181B4
                                                  • Part of subcall function 00818191: GetDiskFreeSpaceW.KERNEL32(00000001,00816B24,?,?,?,?,?,?,?,?,?,?,?,?,00816B24,00000001), ref: 00818204
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
                                                • String ID: :
                                                • API String ID: 4250411929-336475711
                                                • Opcode ID: 232d2eb3ccd508a38384ce4509d81893ca4146ef3f79e99e607844a3fbb2106f
                                                • Instruction ID: 1bb854b3bf9cc2ba116250c98c35c9c3cda5c87ef77a01e0f01fdec11daf3c1d
                                                • Opcode Fuzzy Hash: 232d2eb3ccd508a38384ce4509d81893ca4146ef3f79e99e607844a3fbb2106f
                                                • Instruction Fuzzy Hash: 4D519DB1A04309EEDB21DBA8C840DEABBFCFF04318F04C459E5D9D7251E271A994CB61
                                                Function 0083AAC6 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0083AACB
                                                  • Part of subcall function 0082809F: __EH_prolog.LIBCMT ref: 008280A4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: : $...$Junction: $REPARSE:
                                                • API String ID: 3519838083-1476144188
                                                • Opcode ID: 12bd091bc218dea79b8fc83db3c52af7f93573ccc226ed4e94d917ddc0bd1e3a
                                                • Instruction ID: a39a222bd95a1665b5c30d09450f23042164a43cc8717a78ebd2e5aad19d87c0
                                                • Opcode Fuzzy Hash: 12bd091bc218dea79b8fc83db3c52af7f93573ccc226ed4e94d917ddc0bd1e3a
                                                • Instruction Fuzzy Hash: 9B41E671A001189BCF18EF68C481AFDBB7AFF94310F044409E896E7282DB349A86D7D3
                                                Function 0082B99F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082B9A4
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfree
                                                • String ID: act:$ cpus:$ gran:$ page:
                                                • API String ID: 1978129608-454015223
                                                • Opcode ID: 31c9fa42be29b725e39e9115ffd2a5dc61352afc57d1659f5e71b810b248028a
                                                • Instruction ID: 0553e04d35247d4bffbc9e21c9aa3eac4a052af52201dd634ae2174c7bc61b7d
                                                • Opcode Fuzzy Hash: 31c9fa42be29b725e39e9115ffd2a5dc61352afc57d1659f5e71b810b248028a
                                                • Instruction Fuzzy Hash: 11418C717017209BDB28AA289C926BE73B6FF94714F00493DB45BE66C6DB789CC48352
                                                Function 00842A5C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: strlen$fputs
                                                • String ID:
                                                • API String ID: 1552308726-399585960
                                                • Opcode ID: c0903f06830b664394e88071004462cb3e82dbd999a2aa4af2358afaeead46d2
                                                • Instruction ID: 9eab150cf166c3b1e79be566e9afd73331d34c2614e4a6800904a95d0baf35f3
                                                • Opcode Fuzzy Hash: c0903f06830b664394e88071004462cb3e82dbd999a2aa4af2358afaeead46d2
                                                • Instruction Fuzzy Hash: 7541AD3190420A9BDF24EF68D895BED77B5FF44320F41446AE40AE7291DB30AE88CB91
                                                Function 00815209 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0081520E
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,CreateHardLinkW), ref: 00815228
                                                • GetProcAddress.KERNEL32(00000000), ref: 0081522F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressH_prologHandleModuleProc
                                                • String ID: CreateHardLinkW$kernel32.dll
                                                • API String ID: 786088110-294928789
                                                • Opcode ID: 57d3f27627cdfa37a3b188d40aa941fe22151e1f8cdf3cafb6b106907fb29da2
                                                • Instruction ID: 56eb28f9969757ef88a819a2ebe4f1729e9dfae304171a3f6df635e16556db88
                                                • Opcode Fuzzy Hash: 57d3f27627cdfa37a3b188d40aa941fe22151e1f8cdf3cafb6b106907fb29da2
                                                • Instruction Fuzzy Hash: 7C217C73D00519EBCF25EBA8D94AAEEB779FF84700F140129E505F7294CA319D80DBA1
                                                Function 008472A7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008472AC
                                                • fputs.MSVCRT ref: 008472D5
                                                  • Part of subcall function 00814E4A: __EH_prolog.LIBCMT ref: 00814E4F
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • fputs.MSVCRT ref: 00847319
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfputs$fputcfree
                                                • String ID: : $----------------
                                                • API String ID: 1941438168-4071417161
                                                • Opcode ID: 4846a5ac269d4410b6a51f5a3a937c0536a7197187cc0fa72e7f8cf7ebec1c45
                                                • Instruction ID: dbdeeb6bc472ce08ea48f764d1622e6ffdc19cc2ba07cddea9cbc3d6068bedca
                                                • Opcode Fuzzy Hash: 4846a5ac269d4410b6a51f5a3a937c0536a7197187cc0fa72e7f8cf7ebec1c45
                                                • Instruction Fuzzy Hash: AB01D231704600DFCF14AFA8D84A99DBBB6FF84720B10853DF116D76A6CF3098448B42
                                                Function 00848C23 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00848C28
                                                • fputs.MSVCRT ref: 00848C4B
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                • fputs.MSVCRT ref: 00848C87
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog$fputcfree
                                                • String ID: : $Write SFX:
                                                • API String ID: 2632947726-2530961540
                                                • Opcode ID: ea410669d5c805b317e2528678c2c496c380d70d1afdad1c991017f97babf4ad
                                                • Instruction ID: 5c0f4ea713772e051a9a8320747611fbf0162fd44e787b6c63a3ae6d8fc2f5f0
                                                • Opcode Fuzzy Hash: ea410669d5c805b317e2528678c2c496c380d70d1afdad1c991017f97babf4ad
                                                • Instruction Fuzzy Hash: B70188326002049FDF45EFA8E806ADEBBB9FF44310F10402DF519D21A1DF716995DB51
                                                Function 0082B93E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSystemInfo.KERNEL32(?), ref: 0082B960
                                                  • Part of subcall function 0082B99F: __EH_prolog.LIBCMT ref: 0082B9A4
                                                • GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 0082B97A
                                                • GetProcAddress.KERNEL32(00000000), ref: 0082B981
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressH_prologHandleInfoModuleProcSystem
                                                • String ID: GetNativeSystemInfo$kernel32.dll
                                                • API String ID: 2024292667-192647395
                                                • Opcode ID: 7e0070b3bd3982c43dd8cdb16c9ba39482413281daf48b7c17bf5133d81e3564
                                                • Instruction ID: 10ac8a59759816b8a4187bbca0e4d3699f0897efd488c743d66d20477ed9333e
                                                • Opcode Fuzzy Hash: 7e0070b3bd3982c43dd8cdb16c9ba39482413281daf48b7c17bf5133d81e3564
                                                • Instruction Fuzzy Hash: 29F0F0326007109BCB01EBA8D848B9DBBF8FF84311F044558E005D3285EBB8E981CBB1
                                                Function 00846F30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32COMMON
                                                Download Yara Rule
                                                APIs
                                                • _CxxThrowException.MSVCRT(?,00888910), ref: 00846F7B
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                • fputs.MSVCRT ref: 00846F5A
                                                • fputs.MSVCRT ref: 00846F5F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$ExceptionThrowfputc
                                                • String ID: @F{v$ERROR:
                                                • API String ID: 2339886702-575220002
                                                • Opcode ID: dd8c355ba650c07edd08f172a55c2d26906aa6b6ead5b17d8fe1e9fda12f6c15
                                                • Instruction ID: 93b9e7667207bbb7a704404f486f00930043410e17950acfea6f12b6b08c3bd4
                                                • Opcode Fuzzy Hash: dd8c355ba650c07edd08f172a55c2d26906aa6b6ead5b17d8fe1e9fda12f6c15
                                                • Instruction Fuzzy Hash: 69F0A775A00618BB8B00BBDC9C0589FB7ACFF45700711046AE540E3312DA755E405BE1
                                                Function 0083FB19 Relevance: 7.8, APIs: 5, Instructions: 348COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID:
                                                • API String ID: 3519838083-0
                                                • Opcode ID: 5327dcd046c0809b0403e6587e842528383c8de6fed83344bbb49c35f0625a01
                                                • Instruction ID: dff35898d46e0339bc97092c20e88f3151c4325ebce3f2d1420e6f5b4ff1d530
                                                • Opcode Fuzzy Hash: 5327dcd046c0809b0403e6587e842528383c8de6fed83344bbb49c35f0625a01
                                                • Instruction Fuzzy Hash: 6CE1BE71900609DFCB21CF68C484AAEBBF5FF89314F14846DEA56DB262CB34E945CB91
                                                Function 0086C270 Relevance: 7.8, APIs: 6, Instructions: 300COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0086E930: WaitForSingleObject.KERNEL32(00000000,000000FF,0086D121,?,?,?,00000000), ref: 0086E933
                                                  • Part of subcall function 0086CB60: EnterCriticalSection.KERNEL32(?,?,?,0086C2B6), ref: 0086CB68
                                                  • Part of subcall function 0086CB60: LeaveCriticalSection.KERNEL32(?,?,?,0086C2B6), ref: 0086CB72
                                                • EnterCriticalSection.KERNEL32(?), ref: 0086C477
                                                • LeaveCriticalSection.KERNEL32(?), ref: 0086C491
                                                • EnterCriticalSection.KERNEL32(?), ref: 0086C4FB
                                                • LeaveCriticalSection.KERNEL32(?), ref: 0086C521
                                                • EnterCriticalSection.KERNEL32(?), ref: 0086C585
                                                • LeaveCriticalSection.KERNEL32(?), ref: 0086C5BD
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeave$ObjectSingleWait
                                                • String ID:
                                                • API String ID: 1755037574-0
                                                • Opcode ID: d0199e303f3d63169141dfbd10d6ae04c2792b8701242484cad19d4da3f52552
                                                • Instruction ID: 06fc5de829fe0d3d717f5970f6b7e2e7ade85710f50c88599a416824bb402e0f
                                                • Opcode Fuzzy Hash: d0199e303f3d63169141dfbd10d6ae04c2792b8701242484cad19d4da3f52552
                                                • Instruction Fuzzy Hash: E3C155712047018FC320DF69C594AAAB7E1FF98314F12892DE9EAC7250EB30F945CB56
                                                Function 008133E0 Relevance: 7.6, APIs: 5, Instructions: 98COMMON
                                                Download Yara Rule
                                                APIs
                                                • WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00813418
                                                • GetLastError.KERNEL32 ref: 00813421
                                                • _CxxThrowException.MSVCRT(?,00882800), ref: 0081343F
                                                • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,?,00000001,00000001), ref: 008134A6
                                                • _CxxThrowException.MSVCRT(0000FDE9,00882800), ref: 008134CE
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                • String ID:
                                                • API String ID: 2296236218-0
                                                • Opcode ID: 9f4ccc2b9ccd345912487839435116f666466afb79677e5dfdc79011f883b143
                                                • Instruction ID: d188f800c35c40d535b827cfd04e9e9890e477b7cfa5776fbbfbedad24830f54
                                                • Opcode Fuzzy Hash: 9f4ccc2b9ccd345912487839435116f666466afb79677e5dfdc79011f883b143
                                                • Instruction Fuzzy Hash: 19319CB1604249BFDB12CF68CC41BEEBBB9FF15304F108069E458D7241D7749A85CBA5
                                                Function 0081E3C2 Relevance: 7.6, APIs: 6, Instructions: 83COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 440c24c05a0bdf6910be800187e86a36bc6152afcf8c6017720eb159d15a33ac
                                                • Instruction ID: 2d16255dd7e6ad6309dbb14e74e626b1618761849cb124cde2bdf835a73eaf71
                                                • Opcode Fuzzy Hash: 440c24c05a0bdf6910be800187e86a36bc6152afcf8c6017720eb159d15a33ac
                                                • Instruction Fuzzy Hash: 92219F71600A096BD7149E24DC82EBA33ACFF60794F108028FC49DB386E665ED848BD5
                                                Function 0081EB58 Relevance: 7.6, APIs: 6, Instructions: 83COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: d2a5b315ea3c38a6c509e6a59c1f5978dc72eef424693e2eb180c61410ccf4df
                                                • Instruction ID: 98beaf72365c2d75bd08572e5d14e4f3632cbee486c1f9e0f0acc634bc2a58a4
                                                • Opcode Fuzzy Hash: d2a5b315ea3c38a6c509e6a59c1f5978dc72eef424693e2eb180c61410ccf4df
                                                • Instruction Fuzzy Hash: 002187716006196BD7049E24CC82FBA77ACFF60768F048429FC4ADB386F665DD8487D1
                                                Function 00842CE2 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00842CE7
                                                • fputs.MSVCRT ref: 00842D05
                                                • fputs.MSVCRT ref: 00842D2A
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                • fputs.MSVCRT ref: 00842D44
                                                • fputs.MSVCRT ref: 00842D71
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prologfputcfree
                                                • String ID:
                                                • API String ID: 3247574066-0
                                                • Opcode ID: 0d81aff7aa01c96051122f17890303038ec721dae796ba200e1f0a6132abe5d5
                                                • Instruction ID: ab7a0221fb30d20fe847aa15b913882fb1bba1590c5a75b6c9c0a25cc73e32fa
                                                • Opcode Fuzzy Hash: 0d81aff7aa01c96051122f17890303038ec721dae796ba200e1f0a6132abe5d5
                                                • Instruction Fuzzy Hash: 4A11D0329001199BDF05EFA8DC86ADDBF75FF44350F104166E218E7195DB319AA4CB91
                                                Function 0082506F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow
                                                • String ID: Incorrect volume size:
                                                • API String ID: 2366012087-1799541332
                                                • Opcode ID: 4630eb44cd23f838fd2a454f34f4cd8657e5a6c467b5f3522f1f73a8f8a2f8f0
                                                • Instruction ID: 9414ddbb38ed174e87109ab28f858d239b335997cf60c1ff4967af727b02eb15
                                                • Opcode Fuzzy Hash: 4630eb44cd23f838fd2a454f34f4cd8657e5a6c467b5f3522f1f73a8f8a2f8f0
                                                • Instruction Fuzzy Hash: 3151D431900664DFDB24DF98D845BEDB7B4FF14304F0444A9E449AB296DB70AA88CB52
                                                Function 0084FF4E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 147COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: hcf$mtf$rsfx
                                                • API String ID: 3519838083-3699647704
                                                • Opcode ID: 372120e4e7b564396a2a83f4cb2eb4b667d1f9cc69cfbe6e11b8a3893c127d2c
                                                • Instruction ID: a7cef5098bcaa427d5390c8e55b9f7ae59f8093306594254c1f4976f2708dd7c
                                                • Opcode Fuzzy Hash: 372120e4e7b564396a2a83f4cb2eb4b667d1f9cc69cfbe6e11b8a3893c127d2c
                                                • Instruction Fuzzy Hash: 54517D30900A098B8F19EF94C4419FEB376FF84395B108419ED52EB282DB749D9ECB52
                                                Function 008248C5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008248CA
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 008249D6
                                                • _CxxThrowException.MSVCRT(00000000,00884638), ref: 008249F4
                                                  • Part of subcall function 00824A0A: __EH_prolog.LIBCMT ref: 00824A0F
                                                  • Part of subcall function 00824A0A: _CxxThrowException.MSVCRT(00000000,00884638), ref: 00824AB3
                                                Strings
                                                • There is no second file name for rename pair:, xrefs: 008249C3
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionThrow$H_prolog
                                                • String ID: There is no second file name for rename pair:
                                                • API String ID: 206451386-3412818124
                                                • Opcode ID: 79a45f0c3836914f31df781cdd7418ebc7978ab095b704963b8fbc462f759b4a
                                                • Instruction ID: c0f662432250f941eec0015b2caea2eda7b1fc929b20528c6031a6b6e2d48cce
                                                • Opcode Fuzzy Hash: 79a45f0c3836914f31df781cdd7418ebc7978ab095b704963b8fbc462f759b4a
                                                • Instruction Fuzzy Hash: D5414C3160011AEFCF14DF58E881AAE7B72FF54320F109219F925AB2E6C77499D1CBA1
                                                Function 00842888 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologfputs
                                                • String ID: Name$Size
                                                • API String ID: 1798449854-481755742
                                                • Opcode ID: efbbb511753d567f1604ffa05d8706bc64b9a7443cfde7a9e80bacb4b0e240f8
                                                • Instruction ID: 3df5f0c018bc528f12712e2028efed59a097d6e8fecc9266f541a378ef0b2d0b
                                                • Opcode Fuzzy Hash: efbbb511753d567f1604ffa05d8706bc64b9a7443cfde7a9e80bacb4b0e240f8
                                                • Instruction Fuzzy Hash: DA31C431A042199BCF05EF68C885AEDBBB5FF84310F144028F859DB296CB34A981CB91
                                                Function 00848CAD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$fputc
                                                • String ID: : Removing files after including to archive$Removing
                                                • API String ID: 1185151155-1218467041
                                                • Opcode ID: b3ba8ca674a4a63e7aeec792abb8e940ba30417e6b8286c80d2c521e51185375
                                                • Instruction ID: 58740d09d14b2d2e251eb38b536a8d3d3f2f8f64a29934002e70708a92a4c23d
                                                • Opcode Fuzzy Hash: b3ba8ca674a4a63e7aeec792abb8e940ba30417e6b8286c80d2c521e51185375
                                                • Instruction Fuzzy Hash: 1F31A432601B05DFDB65EB74D895BEEB3AAFF51300F00481EE19A93191DF203899CB52
                                                Function 0082E34A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082E34F
                                                  • Part of subcall function 0082B608: memset.MSVCRT ref: 0082B620
                                                  • Part of subcall function 0082B608: strlen.MSVCRT ref: 0082B63E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prologmemsetstrlen
                                                • String ID: ?$ MB$RAM
                                                • API String ID: 2475707007-294454972
                                                • Opcode ID: 7e9c3eedca39cd4f5dd4618b7bff201685a3ea080dbb1e3da22e8ee5c6ace259
                                                • Instruction ID: efafa5e6ba746dd965c1b31bfcdb9884b78bd052a8cb7a15bda8de46ff3f9978
                                                • Opcode Fuzzy Hash: 7e9c3eedca39cd4f5dd4618b7bff201685a3ea080dbb1e3da22e8ee5c6ace259
                                                • Instruction Fuzzy Hash: 132138317002149FCB15EF58C84AAAE7BB5FF99710F108419F696DB3E0CB749881DB91
                                                Function 00824A0A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00824A0F
                                                  • Part of subcall function 008258F8: __EH_prolog.LIBCMT ref: 008258FD
                                                • _CxxThrowException.MSVCRT(00000000,00884638), ref: 00824AB3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ExceptionThrow
                                                • String ID: -r0$Unsupported rename command:
                                                • API String ID: 2366012087-1002762148
                                                • Opcode ID: a6581fb139ca7998bfe9e98dfe4bc458ed501cd64789f19a6c98dd6adb610799
                                                • Instruction ID: be8492e96373374e45b300e1f4686d401828ac45d7d86b12573849cb40f38a4b
                                                • Opcode Fuzzy Hash: a6581fb139ca7998bfe9e98dfe4bc458ed501cd64789f19a6c98dd6adb610799
                                                • Instruction Fuzzy Hash: 6811B6719402199ACB14FFA8D8929FEB778FF64700F404019F916E6282DB749A99C7A2
                                                Function 00849243 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: :
                                                • API String ID: 2614055831-3653984579
                                                • Opcode ID: 9485b4681efe7bacbcef63beaae7faf94b509c7fe0e19fcf9f1b7a81dbb516a9
                                                • Instruction ID: f58be45d824d700dd52353b000718bc3933ea6a7a10076475fecfb5abfd69a4e
                                                • Opcode Fuzzy Hash: 9485b4681efe7bacbcef63beaae7faf94b509c7fe0e19fcf9f1b7a81dbb516a9
                                                • Instruction Fuzzy Hash: E4117F31500604DBDF25EFA8D886EEEB766FF80300F10441EE95A97255DB306981CB62
                                                Function 00848B34 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prolog
                                                • String ID: Archive size: $Files read from disk
                                                • API String ID: 2614055831-3736835528
                                                • Opcode ID: 5aa051e130b6ad3957c82dff23d1f14c9df9ec0087a8315ee1ec32d19ad211bd
                                                • Instruction ID: 83dd4ed70cb20e729678d5909887176d1693a6981683fb6e72ace6bbd2fbbdbf
                                                • Opcode Fuzzy Hash: 5aa051e130b6ad3957c82dff23d1f14c9df9ec0087a8315ee1ec32d19ad211bd
                                                • Instruction Fuzzy Hash: 3C115A71900605DFCB55EBA8C846BEEBBB9FF14304F004028E216961B1DF70A999CB92
                                                Function 008182D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(ntdll.dll), ref: 008182E6
                                                • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 008182FA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressHandleModuleProc
                                                • String ID: RtlGetVersion$ntdll.dll
                                                • API String ID: 1646373207-1489217083
                                                • Opcode ID: e90aa56741bcab14672e8882f085d6c4e608a32ffbe9f9587a463a8d48798095
                                                • Instruction ID: 9a48d6ae95a1ec8e0be8a86176733cd11a06111eabfbb829010268aba07a41f1
                                                • Opcode Fuzzy Hash: e90aa56741bcab14672e8882f085d6c4e608a32ffbe9f9587a463a8d48798095
                                                • Instruction Fuzzy Hash: 15F0E930B5021886CF3567349C5B6FA32ACFF21709F0045A8E117E2185DFB8C9C0CEA5
                                                Function 00842D8D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$fputc
                                                • String ID: $:
                                                • API String ID: 1185151155-4041779174
                                                • Opcode ID: 2fd47816e334d91ef286358cc82af9844b05f84841cc8b78b836d8cfcfaaefc9
                                                • Instruction ID: f0a17d4510532eceeb1cc0487753561976a1c3b21145930cc20a6e166291e6e5
                                                • Opcode Fuzzy Hash: 2fd47816e334d91ef286358cc82af9844b05f84841cc8b78b836d8cfcfaaefc9
                                                • Instruction Fuzzy Hash: 25F08235900258ABCF116F94DC09DDE7F69FF99314F040419ED5563251C7749554CBA2
                                                Function 0082F0FB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(ntdll.dll,?,0082C175), ref: 0082F103
                                                • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0082F113
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressHandleModuleProc
                                                • String ID: RtlGetVersion$ntdll.dll
                                                • API String ID: 1646373207-1489217083
                                                • Opcode ID: db31df87149cecb880f23f0e540a4ad7ce2f52e8824cb40fc7adbee1bb16025a
                                                • Instruction ID: d835ed44d2471531932b56bb90190802ebf0644c1e1d6a011410d8527a8a941b
                                                • Opcode Fuzzy Hash: db31df87149cecb880f23f0e540a4ad7ce2f52e8824cb40fc7adbee1bb16025a
                                                • Instruction Fuzzy Hash: 2FD0A73134423059B61066F57C1DEF63258FB51711744403AF414D2149E6C4CCC18670
                                                Function 0084501A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                Download Yara Rule
                                                APIs
                                                • fputs.MSVCRT ref: 00845027
                                                • fputs.MSVCRT ref: 00845030
                                                  • Part of subcall function 00812110: fputs.MSVCRT ref: 0081212D
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$fputc
                                                • String ID: F{v$Archives
                                                • API String ID: 1185151155-3828071846
                                                • Opcode ID: 4482f0fc9d8c55a2cbd34cdb44c5763c6d0a574e997a3c5332d934c1e1e53efd
                                                • Instruction ID: 22097cf916855fc6a1570938e867d4e349a20746aed4d2c769d34da808aef0fa
                                                • Opcode Fuzzy Hash: 4482f0fc9d8c55a2cbd34cdb44c5763c6d0a574e997a3c5332d934c1e1e53efd
                                                • Instruction Fuzzy Hash: BDD05B3270025467DB11BFA99C09C9FBAAAFFC47107150C2FF994C3261CA7198A49FE1
                                                Function 0085FA70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(kernel32.dll,GetLargePageMinimum,00823DCD), ref: 0085FA7A
                                                • GetProcAddress.KERNEL32(00000000), ref: 0085FA81
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: AddressHandleModuleProc
                                                • String ID: GetLargePageMinimum$kernel32.dll
                                                • API String ID: 1646373207-2515562745
                                                • Opcode ID: 4f3ace5593f7b6b2d484d40203e066dd8f5b8b3eec36d768c12b7a546b7cb9f7
                                                • Instruction ID: 2ffb3a874ba0b751eb3df8c666d420444b29eb14e80b236be19b8bec583e0c61
                                                • Opcode Fuzzy Hash: 4f3ace5593f7b6b2d484d40203e066dd8f5b8b3eec36d768c12b7a546b7cb9f7
                                                • Instruction Fuzzy Hash: 4BD0A9382803238AAB116FA08D0CA393398FE207073040038AE38C209EEF30C4C8CB32
                                                Function 008192A8 Relevance: 6.3, APIs: 5, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: a0932e34af42b02ab524c92ffa10688018feb9c45b478baa22ff289dfe969943
                                                • Instruction ID: 7385d0903883c7fc16fa79f83f46ab48c24ceb7f7c4e6fffdd11ecbb6acf723b
                                                • Opcode Fuzzy Hash: a0932e34af42b02ab524c92ffa10688018feb9c45b478baa22ff289dfe969943
                                                • Instruction Fuzzy Hash: 0A119D317403056BD7149E248C52FEA33A8FF64B50F048428FCAAEA3C2E6A5E9949795
                                                Function 0084D628 Relevance: 6.3, APIs: 5, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 0d2857a50c9647a7e16689e1b73d4b7873983ce5abbf5ac7530f8dadc8aaab16
                                                • Instruction ID: 658e45512a6e3f7c24da1ae39381ada7140d6d1673e00ef663d88c0894f2648d
                                                • Opcode Fuzzy Hash: 0d2857a50c9647a7e16689e1b73d4b7873983ce5abbf5ac7530f8dadc8aaab16
                                                • Instruction Fuzzy Hash: 7411E23130030967D7149E248C02FA933A4FBB4B14F018428FC4EEA2C6F2A9E9509BC9
                                                Function 0081332B Relevance: 6.3, APIs: 5, Instructions: 66COMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,000004B0,?,?,?,?,00811A81,0000FDE9,?,7FFFFFE0,?), ref: 00813357
                                                • GetLastError.KERNEL32(?,?,?,00811A81,0000FDE9,?,7FFFFFE0,?,00000000,?,00000001,00000000), ref: 00813360
                                                • _CxxThrowException.MSVCRT(00000000,00882800), ref: 0081337A
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00811A81,0000FDE9,?,7FFFFFE0,?,00000000), ref: 0081339F
                                                • _CxxThrowException.MSVCRT(00000000,00882800), ref: 008133B5
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                • String ID:
                                                • API String ID: 2296236218-0
                                                • Opcode ID: 7e53b92bd79a52697fc3b12c17a429c9e08d405cc99e9947fd8b9d6cfa28f21e
                                                • Instruction ID: 88551bbd90cf98e580cc8dc842f98511b3ea397e017131ef5430887fa4d0c96d
                                                • Opcode Fuzzy Hash: 7e53b92bd79a52697fc3b12c17a429c9e08d405cc99e9947fd8b9d6cfa28f21e
                                                • Instruction Fuzzy Hash: 7F112EB5600605BFD714DF55DC81EAAB7EDFF443547208129E928D7250DB70ED80CBA4
                                                Function 008327AA Relevance: 6.3, APIs: 4, Instructions: 307stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008327AF
                                                  • Part of subcall function 00814641: __EH_prolog.LIBCMT ref: 00814646
                                                • strcmp.MSVCRT ref: 00832859
                                                  • Part of subcall function 0081150C: __EH_prolog.LIBCMT ref: 00811511
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                  • Part of subcall function 0082086B: __EH_prolog.LIBCMT ref: 00820870
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$freestrcmp
                                                • String ID:
                                                • API String ID: 4197192761-0
                                                • Opcode ID: 73d01dfda3fc0759627256de129f0172e3de4dd0d35fa242a52477ed8838b39c
                                                • Instruction ID: d16bc8321e99cd4199df9ce4d05a3af1f922cc511ed3f5789dd9cb710aa41b39
                                                • Opcode Fuzzy Hash: 73d01dfda3fc0759627256de129f0172e3de4dd0d35fa242a52477ed8838b39c
                                                • Instruction Fuzzy Hash: 4BC14431800159EFCF15EFA8D895AECBB75FF54314F248068E416B72A2DB345A89CB92
                                                Function 00849041 Relevance: 6.1, APIs: 4, Instructions: 96COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00849046
                                                • EnterCriticalSection.KERNEL32(0088C818,?,00000001,?,?,0084939E,?,0000006F,?,?,00000000), ref: 0084905A
                                                • fputs.MSVCRT ref: 008490AB
                                                • LeaveCriticalSection.KERNEL32(0088C818,?,00000001,?,?,0084939E,?,0000006F,?,?,00000000), ref: 00849170
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterH_prologLeavefputs
                                                • String ID:
                                                • API String ID: 2174113412-0
                                                • Opcode ID: 7365c23e7270ca92251faf9a69114ed533462c36c28fb552ca6a3f3dfb78cc41
                                                • Instruction ID: 173df9c5988faf667fd5dc58f7f1600cbc2d43cee1bfd22152fe13361ca7ce87
                                                • Opcode Fuzzy Hash: 7365c23e7270ca92251faf9a69114ed533462c36c28fb552ca6a3f3dfb78cc41
                                                • Instruction Fuzzy Hash: 19318D31600749EFCF21AF68C495AEEBBA6FF45310F04852EF59AD7251CB34A844DB92
                                                Function 0082F723 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,00000000,?,00000000,?), ref: 0082F776
                                                • GetLastError.KERNEL32(?,00000000,?), ref: 0082F79B
                                                • GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,?,?,00000000,?), ref: 0082F7D8
                                                • GetLastError.KERNEL32(?,?,?,?,?,00000000,?), ref: 0082F7EE
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorFileLastSecurity
                                                • String ID:
                                                • API String ID: 555121230-0
                                                • Opcode ID: 8bd33386d17ab6eda5bfea7ad37cf035f4dd7d1d01c36e4fa138a56e4ba85e56
                                                • Instruction ID: c6a4dd3296de369437b7639d7a0f9c4ca1917000c0243dbfaf0b02242d6eaab2
                                                • Opcode Fuzzy Hash: 8bd33386d17ab6eda5bfea7ad37cf035f4dd7d1d01c36e4fa138a56e4ba85e56
                                                • Instruction Fuzzy Hash: 83315A74900219EFDB10DFA4D884BAEBBB5FF44304F108979E569E7291D770AE81DBA0
                                                Function 008171BC Relevance: 6.1, APIs: 4, Instructions: 77COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008171C1
                                                • GetFileInformationByHandle.KERNEL32(000000FF,?,?,00000000,00000001,00000003,02200000,?,?,00000000), ref: 0081720D
                                                • DeviceIoControl.KERNEL32(000000FF,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 0081723A
                                                • memcpy.MSVCRT ref: 00817259
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ControlDeviceFileH_prologHandleInformationfreememcpy
                                                • String ID:
                                                • API String ID: 1689166341-0
                                                • Opcode ID: ecc9defebcb81701d9d30988c0fef3fb89ef34b892b75614853c6fe6e872a5c3
                                                • Instruction ID: 128116ae1453579145e41e05a3bdc96ff1a37df97a66e3591004f83f5cd87b2c
                                                • Opcode Fuzzy Hash: ecc9defebcb81701d9d30988c0fef3fb89ef34b892b75614853c6fe6e872a5c3
                                                • Instruction Fuzzy Hash: 9021AF72900104AEDF21AF98DC85AEE7BBDFF44350F24412EF909E7291CA318E84CA61
                                                Function 0086E790 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcpy
                                                • String ID: @
                                                • API String ID: 3510742995-2766056989
                                                • Opcode ID: 1b37c88fd29cbb5bcd41ef153ab368956c1d8a4bb41b30212873f7d185234c8b
                                                • Instruction ID: 7842b04c5a698e6bc1aa9629d126b24c590535acdd9bc1eaae1815b4a9fa84dd
                                                • Opcode Fuzzy Hash: 1b37c88fd29cbb5bcd41ef153ab368956c1d8a4bb41b30212873f7d185234c8b
                                                • Instruction Fuzzy Hash: 8111C8F79043085BC710EF59FC8499B775CFB99360F12452AFD0997206E661D905C6E2
                                                Function 0084043F Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00840444
                                                • EnterCriticalSection.KERNEL32(0088C7D0), ref: 00840460
                                                • LeaveCriticalSection.KERNEL32(0088C7D0), ref: 00840488
                                                • LeaveCriticalSection.KERNEL32(0088C7D0), ref: 008404C9
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$Leave$EnterH_prolog
                                                • String ID:
                                                • API String ID: 2532973370-0
                                                • Opcode ID: 02dd121bd76dea6d126125d409301b0d42beb222442fd5cdc92eb4009f23636a
                                                • Instruction ID: ae8760e999da0adfb12c72128239037aa39804da8e42c315db599e5f385a1026
                                                • Opcode Fuzzy Hash: 02dd121bd76dea6d126125d409301b0d42beb222442fd5cdc92eb4009f23636a
                                                • Instruction Fuzzy Hash: 9B117C36600605DBC710DF99D8C4A6EB7A4FB9D718B10852DE70AEBA05CB74EC418FA4
                                                Function 008419F0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008419F5
                                                • EnterCriticalSection.KERNEL32(0088C7F0), ref: 00841A07
                                                • fputs.MSVCRT ref: 00841A57
                                                  • Part of subcall function 00811E8A: __EH_prolog.LIBCMT ref: 00811E8F
                                                  • Part of subcall function 00811E8A: fputs.MSVCRT ref: 00811F02
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811E68: fflush.MSVCRT ref: 00811E6A
                                                • LeaveCriticalSection.KERNEL32(0088C7F0), ref: 00841A83
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalH_prologSectionfputs$EnterLeavefflushfputc
                                                • String ID:
                                                • API String ID: 84800229-0
                                                • Opcode ID: 0a6bf0d8381ae2557b19f26cbd91a4ca0827026588d8929c83deb882cef86400
                                                • Instruction ID: a7b049c59b04f4b91df3c789c2b26d3d818871129277daf34b5247753a705c36
                                                • Opcode Fuzzy Hash: 0a6bf0d8381ae2557b19f26cbd91a4ca0827026588d8929c83deb882cef86400
                                                • Instruction Fuzzy Hash: 98113C71600604DBDB15EF68DC9DAAEF7B5FF88314F14841EE95AE7211DB30A884CB61
                                                Function 008404DC Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008404E1
                                                • EnterCriticalSection.KERNEL32(0088C7D0), ref: 008404F6
                                                • _CxxThrowException.MSVCRT(?,00882800), ref: 00840533
                                                • LeaveCriticalSection.KERNEL32(0088C7D0,00000000,00000000,?,00882800), ref: 0084054C
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterExceptionH_prologLeaveThrow
                                                • String ID:
                                                • API String ID: 4150843469-0
                                                • Opcode ID: b7abd3c2473313ff72a4ac71e2fabbbe97fa9d92bca1ce0e7c2b7d13a8c75a12
                                                • Instruction ID: 7412d9b280adf2066dc7e69c87909dc97642afa98369096f13063c90883dca6f
                                                • Opcode Fuzzy Hash: b7abd3c2473313ff72a4ac71e2fabbbe97fa9d92bca1ce0e7c2b7d13a8c75a12
                                                • Instruction Fuzzy Hash: 6A018C7190061AEFDB04EF98D885AAEB778FF45305F10812AE519F2601DBB0AA44CFA5
                                                Function 00848F14 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00848F19
                                                • fputs.MSVCRT ref: 00848F48
                                                • fputs.MSVCRT ref: 00848F51
                                                • fputs.MSVCRT ref: 00848F58
                                                  • Part of subcall function 00811E77: fputc.MSVCRT ref: 00811E7E
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$H_prologfputcfree
                                                • String ID:
                                                • API String ID: 3247574066-0
                                                • Opcode ID: 6a18184614f4212782b223ea6d5d78692e779475f93a94a6a416bd71876f342b
                                                • Instruction ID: 58c65e14e10fb2611de1357d9deac3bab8fa8014abd56ee4729adb5b157b87a6
                                                • Opcode Fuzzy Hash: 6a18184614f4212782b223ea6d5d78692e779475f93a94a6a416bd71876f342b
                                                • Instruction Fuzzy Hash: 0BF06232D000289BCB05AB9CDC469EEBF79FF80310F10402AE609A32A5DB3549A1DBC1
                                                Function 00832D7A Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 394COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00832D7F
                                                  • Part of subcall function 0082F640: __EH_prolog.LIBCMT ref: 0082F645
                                                  • Part of subcall function 0083107F: __EH_prolog.LIBCMT ref: 00831084
                                                  • Part of subcall function 00833309: __EH_prolog.LIBCMT ref: 0083330E
                                                  • Part of subcall function 008327AA: __EH_prolog.LIBCMT ref: 008327AF
                                                  • Part of subcall function 008327AA: strcmp.MSVCRT ref: 00832859
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$strcmp
                                                • String ID: Scanning error
                                                • API String ID: 828347417-2691707340
                                                • Opcode ID: 52099b69dd1eb234a6ea1c3e6a8c733a5fd8d1876b80accc03d304e90900d942
                                                • Instruction ID: bfe6158e611227299967eefe3837fadde81ae4c720cf22dfdd751091c13a54d4
                                                • Opcode Fuzzy Hash: 52099b69dd1eb234a6ea1c3e6a8c733a5fd8d1876b80accc03d304e90900d942
                                                • Instruction Fuzzy Hash: 74F1AC30900259EFCF25DBA8C854BEDBBB5FF94314F148199E459E7292DB708E84CB92
                                                Function 008353D1 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: Unknown error$Unknown warning
                                                • API String ID: 3519838083-4291957651
                                                • Opcode ID: 17ebb46a6d1e24c2f75eb4e64c62c48575d6f51bcd8e6b401f928d19bad390c1
                                                • Instruction ID: 8e397aff0bc79e46831ed6ed34638b1bcec5c6577b82584a2d7aec97112ffdfd
                                                • Opcode Fuzzy Hash: 17ebb46a6d1e24c2f75eb4e64c62c48575d6f51bcd8e6b401f928d19bad390c1
                                                • Instruction Fuzzy Hash: 44915F71900609CBCB14DFA8C581AEEB7F5FF98300F50896DE45AE7291E770AE48CB95
                                                Function 00854639 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog__aullrem
                                                • String ID: wav
                                                • API String ID: 3415659256-1803495720
                                                • Opcode ID: 33f05d192178b26f94fba4aeae5d6efc03e7003d5fe3edbeb8ab326b7df8966d
                                                • Instruction ID: ae2a0dcfca1a04e9f24a516ff79015928330546603aff22200317c8610b52e94
                                                • Opcode Fuzzy Hash: 33f05d192178b26f94fba4aeae5d6efc03e7003d5fe3edbeb8ab326b7df8966d
                                                • Instruction Fuzzy Hash: 1761AB74A002098FCF25CF98C484BAEBBF5FF4A30AF249559D855EB291C7709D89CB81
                                                Function 0084EBCD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0084EBD2
                                                  • Part of subcall function 008503A0: __EH_prolog.LIBCMT ref: 008503A5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: Copy$LZMA2
                                                • API String ID: 3519838083-1006940721
                                                • Opcode ID: f803639af949234ca99de1781e2581f7e27b105d6d2dc62e2c7ee96ee2972b26
                                                • Instruction ID: a5bf803f58be18e9f645e7bfe5f51f028d3f98851d6163446ca510222a95a0c4
                                                • Opcode Fuzzy Hash: f803639af949234ca99de1781e2581f7e27b105d6d2dc62e2c7ee96ee2972b26
                                                • Instruction Fuzzy Hash: 0E61AE30E006088FDB29EF68C4947BEB3E5FF50314F14852DD5A2D66A2DB74E985CB12
                                                Function 0082313A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: @$crc
                                                • API String ID: 3519838083-849529298
                                                • Opcode ID: 06720747f9cf9d418cc95edbe0416db55512c140ac464c2bb8c32c7b34f7e583
                                                • Instruction ID: 765426bb180c59be42b9708cd0c1fd7bf5f9f5dfc8a14529634e37a64bce41d7
                                                • Opcode Fuzzy Hash: 06720747f9cf9d418cc95edbe0416db55512c140ac464c2bb8c32c7b34f7e583
                                                • Instruction Fuzzy Hash: F3518371900219EBCF11EF98E8959EEB779FF04354F108429E806E7251DB789F89CB91
                                                Function 008252D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 008252DD
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 008254AF
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                • incorrect update switch command, xrefs: 0082549C
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionH_prologThrowfree
                                                • String ID: incorrect update switch command
                                                • API String ID: 2564996034-2497410926
                                                • Opcode ID: a5d56742db7b7f34fb2dc52f662234abe3778073e803ce75a1db561cbb7eb8ee
                                                • Instruction ID: 241710af1d29f85b6e6d20d5ae8b3805924e2767de7080ff76a32164b6a68663
                                                • Opcode Fuzzy Hash: a5d56742db7b7f34fb2dc52f662234abe3778073e803ce75a1db561cbb7eb8ee
                                                • Instruction Fuzzy Hash: 6E514672C41629DFDF24EB98E945AEDBBB4FF04310F204199E515B7291CB706E84CBA1
                                                Function 0081EDA8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 144COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: BlockPackSize$BlockUnpackSize
                                                • API String ID: 3519838083-5494122
                                                • Opcode ID: 3f53c71a95557a0c6f07e723de488ff8b867d3c7812fab4a5eb814558d5ec004
                                                • Instruction ID: 8f2217d03461258f7ab5c996feabdfe3258d24215574dfac059e238f40796787
                                                • Opcode Fuzzy Hash: 3f53c71a95557a0c6f07e723de488ff8b867d3c7812fab4a5eb814558d5ec004
                                                • Instruction Fuzzy Hash: CE516E71804285DEDF25DB68C494AEC7BBAFF15300F1980A9EC99DB162DB3249C6DB02
                                                Function 0081449D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: wcscmp
                                                • String ID: UNC
                                                • API String ID: 3392835482-337201128
                                                • Opcode ID: 8d40006f6e98ac89303e545fd9abb3b6f1c971eba603ed4ba2bd150fc275eed4
                                                • Instruction ID: d076bbaecf7dc496db398485a7c7f2cab6108ac05891cbcd8f60765d326bc7e6
                                                • Opcode Fuzzy Hash: 8d40006f6e98ac89303e545fd9abb3b6f1c971eba603ed4ba2bd150fc275eed4
                                                • Instruction Fuzzy Hash: 8A2149353006009FDB24CF1CC890AA5B3EAFF85725B299469E65ADF3A5CA31ECC4CB50
                                                Function 00848126 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: __aulldivstrlen
                                                • String ID: M
                                                • API String ID: 1892184250-3664761504
                                                • Opcode ID: e76643d6081b12aa43b52b90bc5e5d4bd0a04d9f0a06f73b31a868fd5b5c1ccb
                                                • Instruction ID: c00c734166aec54dd02df08311a9783428935df745921b3d9fa6f25d0a44a290
                                                • Opcode Fuzzy Hash: e76643d6081b12aa43b52b90bc5e5d4bd0a04d9f0a06f73b31a868fd5b5c1ccb
                                                • Instruction Fuzzy Hash: 6B110832604748ABDB11DAB8CC45FAE77E9FF98310F24486DE286D71C1D971E8468324
                                                Function 00825637 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 0082563C
                                                • _CxxThrowException.MSVCRT(?,00884638), ref: 008256D9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ExceptionH_prologThrow
                                                • String ID: Unsupported charset:
                                                • API String ID: 461045715-616772432
                                                • Opcode ID: 0e06cfb2805fa6dd7da6e2f564f46f8ed0a54a89fa4aa1388be814057c3fa89c
                                                • Instruction ID: 9d8b9dbbbb4789e1495b8a079cd99572261649a46063b37690629dbcc43115d8
                                                • Opcode Fuzzy Hash: 0e06cfb2805fa6dd7da6e2f564f46f8ed0a54a89fa4aa1388be814057c3fa89c
                                                • Instruction Fuzzy Hash: 45213232A404199BCF10EF9CD881DEDB7B5FF69314F414068EA59EB295CB31AE85CB80
                                                Function 00841E51 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: 0$x
                                                • API String ID: 3519838083-1948001322
                                                • Opcode ID: ebd56ef43759afb84d7cb0f3f34c3158478991c497bba2a81422be0d5eb5b4b8
                                                • Instruction ID: 199141ff149351ba4e9faae7c9ab8dc3199c5d286f854ca1a5d940df658a4c7f
                                                • Opcode Fuzzy Hash: ebd56ef43759afb84d7cb0f3f34c3158478991c497bba2a81422be0d5eb5b4b8
                                                • Instruction Fuzzy Hash: C0215B76D011299BCF04EBD8D985AEEB7B9FF98304F10005AE505B7281DB759E84CBA1
                                                Function 0084EB0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: BT2$LZMA
                                                • API String ID: 3519838083-1343681682
                                                • Opcode ID: 0f9566310282abe5bd1ed63ef41d8d447190c1bd7f08b6fa7db34acc480cdd54
                                                • Instruction ID: 781b829f3547195b99800a5e81c9cfb79ef30fdf5aa3b90d5b0bc06f9cee203b
                                                • Opcode Fuzzy Hash: 0f9566310282abe5bd1ed63ef41d8d447190c1bd7f08b6fa7db34acc480cdd54
                                                • Instruction Fuzzy Hash: 96115170A60228AAD714F7A8CD57FEC7364FF14B10F404058F506E61D2EFB45948C752
                                                Function 0082B2BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog
                                                • String ID: / $ :
                                                • API String ID: 3519838083-1815150141
                                                • Opcode ID: 3f9d28b20818d80aa94480b571deeed816abad79e1cda1b999c5f0849e14ea79
                                                • Instruction ID: df59630d2f32954a0e3143dee13e0b483bf826cb1870155fd2e226b7f426434d
                                                • Opcode Fuzzy Hash: 3f9d28b20818d80aa94480b571deeed816abad79e1cda1b999c5f0849e14ea79
                                                • Instruction Fuzzy Hash: DF11EC729001249BCF15EB9CDD96EEEB3B8FF58700F44441DE116B2191DB74AA54CB61
                                                Function 00826862 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                • __EH_prolog.LIBCMT ref: 00826867
                                                • GetLastError.KERNEL32(?), ref: 00826873
                                                  • Part of subcall function 00814E4A: __EH_prolog.LIBCMT ref: 00814E4F
                                                  • Part of subcall function 00811C86: free.MSVCRT(00000000,00833C19,00000001,00000001,?,?,008110EB,?,00000000), ref: 00811C8A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: H_prolog$ErrorLastfree
                                                • String ID: :
                                                • API String ID: 683690243-3653984579
                                                • Opcode ID: 30a7d0e0015f05feb08961c1f84ae7b4d4d794839cd72af5d96c9d9ff7ac4134
                                                • Instruction ID: c9e48ae46c7a9822255963f96072aaf359f648131086fbb32fe1469990b058df
                                                • Opcode Fuzzy Hash: 30a7d0e0015f05feb08961c1f84ae7b4d4d794839cd72af5d96c9d9ff7ac4134
                                                • Instruction Fuzzy Hash: 3301C072D00208DBCF05EBA8D446ADEBB78FF54324F104158F506E3296DB34CA95CBA1
                                                Function 0084412A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                • Can not open encrypted archive. Wrong password?, xrefs: 0084413D
                                                • Can not open the file as archive, xrefs: 00844175
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
                                                • API String ID: 1795875747-2399861261
                                                • Opcode ID: 74b7bb0f8edee7e1dd100407aabe7d4470df9e497c35e2d1218594b06586277b
                                                • Instruction ID: 7cf8f46cb12e55d0a3379bf54257043d57fa7fecc95702349e38db72fa3106ca
                                                • Opcode Fuzzy Hash: 74b7bb0f8edee7e1dd100407aabe7d4470df9e497c35e2d1218594b06586277b
                                                • Instruction Fuzzy Hash: 8E01D631304A049BDA05E798C499B7EB3ABFFC8314F14941EEA02C7A91DB70E891DB52
                                                Function 00843D82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: =
                                                • API String ID: 1795875747-2525689732
                                                • Opcode ID: b8f50567265acf577d45834627a1afec46b2bdb44b6603798b06fb9e8758db92
                                                • Instruction ID: d8b05bb5142b43ab8880c7e4525f5d8fdf0b1a9005ecc34efbc3b3942c485b3a
                                                • Opcode Fuzzy Hash: b8f50567265acf577d45834627a1afec46b2bdb44b6603798b06fb9e8758db92
                                                • Instruction Fuzzy Hash: 8AE0DF71E0021C6B9F00ABA9DC498BA7B39FF80314790083AE615C7249E730E9618BE1
                                                Function 00825013 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenEventW.KERNEL32(00000002,00000000,00000002,Unsupported Map data size,00000002,?,00824FCF,?,?,00000000,?), ref: 00825024
                                                • GetLastError.KERNEL32(?,00824FCF,?,?,00000000,?), ref: 00825031
                                                Strings
                                                • Unsupported Map data size, xrefs: 00825017
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: ErrorEventLastOpen
                                                • String ID: Unsupported Map data size
                                                • API String ID: 330508107-1172413320
                                                • Opcode ID: f4b2c414e8a1615364ad335d14df27ee8408478d11a92ef0e080027c6086a3a1
                                                • Instruction ID: 15f83945356b07013b326a46321532ab77295a0cf12b92ad7c376e5f489cae8f
                                                • Opcode Fuzzy Hash: f4b2c414e8a1615364ad335d14df27ee8408478d11a92ef0e080027c6086a3a1
                                                • Instruction Fuzzy Hash: A7E09230540614EBEF24EFA4ED0BB9DB7ACFF00344F20045DE405E2090FB70AE409A95
                                                Function 00847E5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs$fputc
                                                • String ID: @F{v
                                                • API String ID: 1185151155-3152675431
                                                • Opcode ID: 33f5d48841cdf290c78c295cf410152a5613586b2e77f4e24bf6bf9e1b4e3314
                                                • Instruction ID: ed300cfae25fc680aa280a1ec6832305bb5f39f2d9a9d40b1d570ffd44777764
                                                • Opcode Fuzzy Hash: 33f5d48841cdf290c78c295cf410152a5613586b2e77f4e24bf6bf9e1b4e3314
                                                • Instruction Fuzzy Hash: 0ED0C732B0022867CA207BEC6C0489EB29DFFC4B10302086BEA50D3222CB219C804BE1
                                                Function 00847B6E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: fputs
                                                • String ID: F{v$Unsupported Windows version
                                                • API String ID: 1795875747-3973458785
                                                • Opcode ID: fdffc3ed083ea68ab8c25f5ee8ae9cdb3caf45566b6e1d6d231f5c7d71a81a12
                                                • Instruction ID: 15e48b90565a4af5898ba12da58e784f38bbb572715576f8f7fe9a21f97a1d4a
                                                • Opcode Fuzzy Hash: fdffc3ed083ea68ab8c25f5ee8ae9cdb3caf45566b6e1d6d231f5c7d71a81a12
                                                • Instruction Fuzzy Hash: AED0A737248140DFD7054F48F80AB8437A0F34CB24F10446BD002C6590D77154408B10
                                                Function 00862660 Relevance: 5.1, APIs: 4, Instructions: 112COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0086E930: WaitForSingleObject.KERNEL32(00000000,000000FF,0086D121,?,?,?,00000000), ref: 0086E933
                                                  • Part of subcall function 0086E980: SetEvent.KERNEL32(00000000,00825043,?,00824FCF,?,?,00000000,?), ref: 0086E983
                                                • EnterCriticalSection.KERNEL32(?), ref: 008626D5
                                                • EnterCriticalSection.KERNEL32(?), ref: 008626DE
                                                • LeaveCriticalSection.KERNEL32(?), ref: 008626FA
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00862703
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeave$EventObjectSingleWait
                                                • String ID:
                                                • API String ID: 497781136-0
                                                • Opcode ID: c02213f480cb2a4353fea836160921f0204bbe1849ce4c48a3cf20dd6dcd0546
                                                • Instruction ID: 6e371e6677d30f5e55f15e6b6554bfc5aaf15313dea2cd732f354ccfc514587a
                                                • Opcode Fuzzy Hash: c02213f480cb2a4353fea836160921f0204bbe1849ce4c48a3cf20dd6dcd0546
                                                • Instruction Fuzzy Hash: 0F415F75200B09DFC718EF74C884ADAF3A5FF48304F018A6DE56A8B651DB34BA55CB91
                                                Function 00826076 Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 1ea84c192082b5c0c0bdf28052c33f4c89cb50f4993fc94b503dc088ca90588a
                                                • Instruction ID: 7a71481a641d139c13e43cb3c223f20daeaade7a382c8f21bd4c0dfc382d13b8
                                                • Opcode Fuzzy Hash: 1ea84c192082b5c0c0bdf28052c33f4c89cb50f4993fc94b503dc088ca90588a
                                                • Instruction Fuzzy Hash: 4A11E531340715A7DB149F24DC02FAA73A4FB94B10F048438FD09EA2C2FAA5F9A09785
                                                Function 0083987F Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 485466b069048552f7d5e0e261aaba60e94d99a5f14df01186476e26230f4731
                                                • Instruction ID: 09638430804af23a967cae552f1dea2f76c9c0dcaab3073e38973ce40741b4a2
                                                • Opcode Fuzzy Hash: 485466b069048552f7d5e0e261aaba60e94d99a5f14df01186476e26230f4731
                                                • Instruction Fuzzy Hash: 1A11A132740309A7D7149A248C42FB973A8FBD5B10F048438FD9AEA3C2E6E5E95497D5
                                                Function 00838AF0 Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 3674f69cbb0e9d9ac105c7f05b6242e38065cc442f5916f36ec092b92573609a
                                                • Instruction ID: 878f27f692fc94bd08c9c4e72ebc08ac7f9ce53d66fb667b68ff9f2fc6f82a4c
                                                • Opcode Fuzzy Hash: 3674f69cbb0e9d9ac105c7f05b6242e38065cc442f5916f36ec092b92573609a
                                                • Instruction Fuzzy Hash: 5E01C871740706ABD7149E248C42F69B394FB94B60F048428FD89DB2C2E6A5E85057D5
                                                Function 00846B43 Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: memcmp
                                                • String ID:
                                                • API String ID: 1475443563-0
                                                • Opcode ID: 8ab565a4a4260d5bd53c0a201fce9d7033c60ce2c8a3e7ea1d8a071f2bea9cab
                                                • Instruction ID: c6eedf1a5e3c20d574579b224808808e6c48ba8473c5b7414014252401f4e604
                                                • Opcode Fuzzy Hash: 8ab565a4a4260d5bd53c0a201fce9d7033c60ce2c8a3e7ea1d8a071f2bea9cab
                                                • Instruction Fuzzy Hash: BB01C43174020A67D7109E248C02FBA33A4FB65B64F048438FD49DA3C2F6A6E9649796
                                                Function 00862666 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 0086E930: WaitForSingleObject.KERNEL32(00000000,000000FF,0086D121,?,?,?,00000000), ref: 0086E933
                                                  • Part of subcall function 0086E980: SetEvent.KERNEL32(00000000,00825043,?,00824FCF,?,?,00000000,?), ref: 0086E983
                                                • EnterCriticalSection.KERNEL32(?), ref: 008626D5
                                                • EnterCriticalSection.KERNEL32(?), ref: 008626DE
                                                • LeaveCriticalSection.KERNEL32(?), ref: 008626FA
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00862703
                                                Memory Dump Source
                                                • Source File: 00000009.00000002.2105933578.0000000000811000.00000020.00000001.01000000.00000013.sdmp, Offset: 00810000, based on PE: true
                                                • Associated: 00000009.00000002.2105911266.0000000000810000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2105980866.000000000087C000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106017657.000000000088C000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                • Associated: 00000009.00000002.2106042135.0000000000894000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_9_2_810000_7zr.jbxd
                                                Similarity
                                                • API ID: CriticalSection$EnterLeave$EventObjectSingleWait
                                                • String ID:
                                                • API String ID: 497781136-0
                                                • Opcode ID: 39d77e1fdce2e9dd48c1b612f7dc0785dabfee4366328fcd622b691cac055954
                                                • Instruction ID: 2bb6225af1fdf9b36d21f8d3f98b2785ef66dc4f55f2783e6e2df2dfaebd3eff
                                                • Opcode Fuzzy Hash: 39d77e1fdce2e9dd48c1b612f7dc0785dabfee4366328fcd622b691cac055954
                                                • Instruction Fuzzy Hash: FC015A34600A0AEBCB58EF74C849BD9F368FF54304F010958D96997241EB34BAA4CFD2

                                                Non-executed Functions

                                                Function 00007FF7FD6D84B4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000017.00000002.2531824804.00007FF7FD581000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF7FD580000, based on PE: true
                                                • Associated: 00000017.00000002.2531387908.00007FF7FD580000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2533596210.00007FF7FD713000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534060662.00007FF7FD74C000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534212908.00007FF7FD758000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534399318.00007FF7FD759000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534503421.00007FF7FD75B000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534503421.00007FF7FD760000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2534503421.00007FF7FD763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2535047388.00007FF7FD768000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2535047388.00007FF7FD775000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                • Associated: 00000017.00000002.2535499691.00007FF7FD77B000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_23_2_7ff7fd580000_clearbrowser.jbxd
                                                Similarity
                                                • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                • String ID:
                                                • API String ID: 2933794660-0
                                                • Opcode ID: a492442d2a9d123aca348995f3e3c052a13b8f8ece2ff38acd825dba5e535992
                                                • Instruction ID: 4b05eb87b8b94425392134183cddeeba075d42a14ab0035e41645b694b6d716e
                                                • Opcode Fuzzy Hash: a492442d2a9d123aca348995f3e3c052a13b8f8ece2ff38acd825dba5e535992
                                                • Instruction Fuzzy Hash: 2C114F22B1CF01C9EB009B60E8582A973A4F75D758F840D31DA2D4A7A4EF78E15483E0