Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup (1).exe

Overview

General Information

Sample name:Setup (1).exe
Analysis ID:1459003
MD5:98bf362b34475d3757430ba89833f3be
SHA1:73e7982f3df186d24ef81597e2f8b3ca1704f4da
SHA256:a74f9c40ffa5d7ac67acfd5dcf93cdb351866105dfb6050e5bef181421aa7666
Infos:

Detection

Score:42
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Creates a process in suspended mode (likely to inject code)
Drops PE files
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
PE file contains an invalid checksum
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64_ra
  • Setup (1).exe (PID: 7080 cmdline: "C:\Users\user\Desktop\Setup (1).exe" MD5: 98BF362B34475D3757430BA89833F3BE)
    • chrome.exe (PID: 3348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091o&nocache=20240618121312.538&_fcid=1718724052798659 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • nsgBA2E.tmp (PID: 7680 cmdline: "C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp" /internal 1718724052798659 /force MD5: F748BC5CB1445E361CA987ED89BECABA)
      • PcAppStore.exe (PID: 608 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: FCEFC6099C1265E7F7B703C7A0154C5A)
        • explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • PcAppStore.exe (PID: 2524 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM MD5: FCEFC6099C1265E7F7B703C7A0154C5A)
        • NW_store.exe (PID: 6488 cmdline: .\nwjs\NW_store.exe .\ui\. MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 4636 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980 MD5: E472E46BDFD736351D4B086B4C4CA134)
            • NW_store.exe (PID: 4212 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1a4,0x1a8,0x1ac,0x138,0x1b0,0x7ff6f6438a60,0x7ff6f6438a70,0x7ff6f6438a80 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 4836 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1940 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 4868 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2976 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:3 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 4668 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3220 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:8 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 3704 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\user\PCAppStore\nwjs\gen" --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1718721378693304 --launch-time-ticks=5930592217 --mojo-platform-channel-handle=3316 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2 MD5: E472E46BDFD736351D4B086B4C4CA134)
      • PcAppStoreWatchdog.exe (PID: 5644 cmdline: "C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240618121451.6735912812 /ver=fa.1091o MD5: 5E28DD3006A64174FF0F82469540712E)
  • cleanup
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp, ProcessId: 7680, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpReversingLabs: Detection: 13%
Source: C:\Users\user\PCAppStore\AutoUpdater.exeReversingLabs: Detection: 18%
Source: C:\Users\user\PCAppStore\PcAppStore.exeReversingLabs: Detection: 25%
Source: C:\Users\user\PCAppStore\Uninstaller.exeReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exe
Source: https://td.doubleclick.net/td/rul/858128210?random=1718727198449&cv=11&fst=1718727198449&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.configHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/858128210?random=1718727198468&cv=11&fst=1718727198468&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_viewHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/858128210?random=1718727198863&cv=11&fst=1718727198863&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3DconversionHTTP Parser: No favicon

Compliance

barindex
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exe
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exe
Source: Setup (1).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.0e8f1429.chunk.js.LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txt
Source: Setup (1).exeStatic PE information: certificate valid
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49697 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.146.33.138:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.239.94.126:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49830 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.254:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: Setup (1).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: chrome.exeMemory has grown: Private usage: 0MB later: 33MB
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 2.16.100.64
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global trafficDNS traffic detected: DNS query: pcapp.store
Source: global trafficDNS traffic detected: DNS query: delivery.pcapp.store
Source: global trafficDNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: td.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: repository.pcapp.store
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: analytics.google.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: d74queuslupub.cloudfront.net
Source: global trafficDNS traffic detected: DNS query: 48bd8c19a5fd0a97afed493c575e3391.azr.footprintdns.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49683 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49697 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.146.33.138:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.239.94.126:443 -> 192.168.2.16:49811 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49828 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.4.254:443 -> 192.168.2.16:49830 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.246.254:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.16:49834 version: TLS 1.2
Source: Setup (1).exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal42.evad.winEXE@34/190@30/150
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsg94B2.tmp
Source: Setup (1).exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeFile read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\Setup (1).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\Setup (1).exeFile read: C:\Users\user\Desktop\Setup (1).exe
Source: unknownProcess created: C:\Users\user\Desktop\Setup (1).exe "C:\Users\user\Desktop\Setup (1).exe"
Source: C:\Users\user\Desktop\Setup (1).exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091o&nocache=20240618121312.538&_fcid=1718724052798659
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup (1).exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091o&nocache=20240618121312.538&_fcid=1718724052798659
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1904,i,1090450300907648637,15811627045702687244,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup (1).exeProcess created: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp "C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp" /internal 1718724052798659 /force
Source: C:\Users\user\Desktop\Setup (1).exeProcess created: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp "C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp" /internal 1718724052798659 /force
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe "C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240618121451.6735912812 /ver=fa.1091o
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe .\nwjs\NW_store.exe .\ui\.
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1a4,0x1a8,0x1ac,0x138,0x1b0,0x7ff6f6438a60,0x7ff6f6438a70,0x7ff6f6438a80
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1940 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2976 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3220 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\user\PCAppStore\nwjs\gen" --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1718721378693304 --launch-time-ticks=5930592217 --mojo-platform-channel-handle=3316 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe "C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240618121451.6735912812 /ver=fa.1091o
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: apphelp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: dwmapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: version.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: shfolder.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wininet.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: winhttp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: mswsock.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: winnsi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: schannel.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: dpapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: riched20.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: usp10.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: msls31.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: textshaping.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: ieframe.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: netapi32.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: wkscli.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: secur32.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: mlang.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: policymanager.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Desktop\Setup (1).exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpSection loaded: cscapi.dll
Source: C:\Users\user\Desktop\Setup (1).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore
Source: Setup (1).exeStatic PE information: certificate valid
Source: Setup (1).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Setup (1).exeStatic PE information: real checksum: 0x281af should be: 0x22e57
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\PcAppStoreWatchdog.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\AppData\Local\Temp\nseCD34.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeFile created: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.0e8f1429.chunk.js.LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txt

Boot Survival

barindex
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreWatchdog
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreWatchdog
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreWatchdog
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup (1).exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseCD34.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup (1).exeProcess information queried: ProcessInformation
Source: C:\Users\user\Desktop\Setup (1).exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091o&nocache=20240618121312.538&_fcid=1718724052798659
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe c:\users\user\pcappstore\nwjs\nw_store.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\pc_app_store\user data\crashpad" "--metrics-dir=c:\users\user\appdata\local\pc_app_store\user data" --annotation=plat=win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe c:\users\user\pcappstore\nwjs\nw_store.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\pc_app_store\user data\crashpad" --annotation=plat=win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1a4,0x1a8,0x1ac,0x138,0x1b0,0x7ff6f6438a60,0x7ff6f6438a70,0x7ff6f6438a80
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=gpu-process --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1940 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2976 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3220 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=renderer --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=c:\users\user\pcappstore\nwjs\gen" --no-zygote --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1718721378693304 --launch-time-ticks=5930592217 --mojo-platform-channel-handle=3316 --field-trial-handle=1948,i,11577703543776296676,4197277004636328407,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup (1).exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsgBA2E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation
1
Windows Service
1
Windows Service
1
Masquerading
OS Credential Dumping23
Security Software Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter
111
Registry Run Keys / Startup Folder
11
Process Injection
121
Virtualization/Sandbox Evasion
LSASS Memory121
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading
111
Registry Run Keys / Startup Folder
11
Process Injection
Security Account Manager1
Process Discovery
SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
DLL Search Order Hijacking
1
DLL Side-Loading
1
DLL Side-Loading
NTDS1
File and Directory Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Search Order Hijacking
1
DLL Search Order Hijacking
LSA Secrets132
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Extra Window Memory Injection
1
Extra Window Memory Injection
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg94B3.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp13%ReversingLabsWin32.Trojan.Generic
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nseCD34.tmp\Math.dll0%ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe18%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe25%ReversingLabs
C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe8%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe58%ReversingLabsWin32.Trojan.Nemesis
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
1715720427.rsc.cdn77.org
195.181.170.19
truefalse
    unknown
    t-9999.t-msedge.net
    13.107.246.254
    truefalse
      unknown
      google.com
      216.58.206.78
      truefalse
        unknown
        analytics-alv.google.com
        216.239.36.181
        truefalse
          unknown
          googleads.g.doubleclick.net
          216.58.212.162
          truefalse
            unknown
            1285660440.rsc.cdn77.org
            156.146.33.138
            truefalse
              unknown
              c-9999.c-msedge.net
              13.107.4.254
              truefalse
                unknown
                td.doubleclick.net
                142.250.186.34
                truefalse
                  unknown
                  www.google.com
                  142.250.185.164
                  truefalse
                    unknown
                    pcapp.store
                    104.248.126.225
                    truefalse
                      unknown
                      d74queuslupub.cloudfront.net
                      18.239.94.126
                      truefalse
                        unknown
                        stats.g.doubleclick.net
                        66.102.1.155
                        truefalse
                          unknown
                          repository.pcapp.store
                          unknown
                          unknownfalse
                            unknown
                            48bd8c19a5fd0a97afed493c575e3391.azr.footprintdns.com
                            unknown
                            unknownfalse
                              unknown
                              analytics.google.com
                              unknown
                              unknownfalse
                                unknown
                                delivery.pcapp.store
                                unknown
                                unknownfalse
                                  unknown
                                  NameMaliciousAntivirus DetectionReputation
                                  https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1718724052798659&_winver=19045&version=fa.1091ofalse
                                    unknown
                                    https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1112610034.1718727199&gtm=45je46c0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=367992183false
                                      unknown
                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs
                                      IPDomainCountryFlagASNASN NameMalicious
                                      216.239.34.181
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      172.217.18.14
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      216.58.206.78
                                      google.comUnited States
                                      15169GOOGLEUSfalse
                                      173.194.76.84
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      142.250.185.100
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      66.102.1.155
                                      stats.g.doubleclick.netUnited States
                                      15169GOOGLEUSfalse
                                      142.250.185.164
                                      www.google.comUnited States
                                      15169GOOGLEUSfalse
                                      142.250.185.142
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      156.146.33.138
                                      1285660440.rsc.cdn77.orgUnited States
                                      3743ARCEL-2USfalse
                                      104.248.126.225
                                      pcapp.storeUnited States
                                      14061DIGITALOCEAN-ASNUSfalse
                                      212.102.56.181
                                      unknownItaly
                                      60068CDN77GBfalse
                                      142.250.186.35
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      142.250.186.34
                                      td.doubleclick.netUnited States
                                      15169GOOGLEUSfalse
                                      216.239.36.181
                                      analytics-alv.google.comUnited States
                                      15169GOOGLEUSfalse
                                      18.239.94.126
                                      d74queuslupub.cloudfront.netUnited States
                                      16509AMAZON-02USfalse
                                      195.181.170.19
                                      1715720427.rsc.cdn77.orgUnited Kingdom
                                      60068CDN77GBfalse
                                      216.58.206.67
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      216.58.206.68
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      142.250.185.170
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      239.255.255.250
                                      unknownReserved
                                      unknownunknownfalse
                                      216.58.212.162
                                      googleads.g.doubleclick.netUnited States
                                      15169GOOGLEUSfalse
                                      45.32.1.23
                                      unknownUnited States
                                      20473AS-CHOOPAUSfalse
                                      142.250.186.168
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      172.217.16.195
                                      unknownUnited States
                                      15169GOOGLEUSfalse
                                      IP
                                      192.168.2.16
                                      Joe Sandbox version:40.0.0 Tourmaline
                                      Analysis ID:1459003
                                      Start date and time:2024-06-18 18:12:38 +02:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Number of analysed new started processes analysed:33
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:1
                                      Technologies:
                                      • EGA enabled
                                      Analysis Mode:stream
                                      Sample name:Setup (1).exe
                                      Detection:MAL
                                      Classification:mal42.evad.winEXE@34/190@30/150
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe
                                      • Exclude process from analysis (whitelisted): dllhost.exe
                                      • Excluded IPs from analysis (whitelisted): 199.232.214.172, 172.217.16.195, 172.217.18.14, 173.194.76.84, 34.104.35.123, 142.250.185.170, 142.250.186.168, 142.250.186.35
                                      • Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, www.googletagmanager.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Timeout during stream target processing, analysis might miss dynamic analysis data
                                      • VT rate limit hit for: Setup (1).exe
                                      Process:C:\Windows\explorer.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):112552
                                      Entropy (8bit):4.026956130401378
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:1A84D8FF2E93805654D6F039C50D8A4A
                                      SHA1:550C95F425277FDD1DEB41687E8FDF8C6C164AA4
                                      SHA-256:F4436CB4F87FADA79FDCEA6FEDBDD8176B28E7031CC1A3D2BCA81A8A14AE998C
                                      SHA-512:DD580EA452C48FA7473B9C241EDDA6DF1EC33C87C90AC72494A47936CBB045C8AE7A0E559D1A5125D16C3699DD2CE5D2F0D0B2DE984431FC3F399B28EEB4F549
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:....h... ...............P..............._...x...d......................].......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................... ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i..
                                      Process:C:\Users\user\PCAppStore\PcAppStoreWatchdog.exe
                                      File Type:GIF image data, version 89a, 1 x 1
                                      Category:dropped
                                      Size (bytes):42
                                      Entropy (8bit):2.9881439641616536
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:GIF89a.............!.......,...........D.;
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):69120
                                      Entropy (8bit):6.024967061017882
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:85428CF1F140E5023F4C9D179B704702
                                      SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                                      SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                                      SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):12288
                                      Entropy (8bit):5.814115788739565
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CFF85C549D536F651D4FB8387F1976F2
                                      SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                      SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                      SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:GIF image data, version 89a, 16 x 16
                                      Category:dropped
                                      Size (bytes):997
                                      Entropy (8bit):4.188896534234179
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:1636218C14C357455B5C872982E2A047
                                      SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                      SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                      SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:modified
                                      Size (bytes):39424
                                      Entropy (8bit):4.684597989866362
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                      SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                      SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                      SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                      Category:dropped
                                      Size (bytes):26494
                                      Entropy (8bit):1.9568109962493656
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                      SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                      SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                      SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):9728
                                      Entropy (8bit):5.158136237602734
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6C3F8C94D0727894D706940A8A980543
                                      SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                                      SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                                      SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):24064
                                      Entropy (8bit):5.819708895488079
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                      SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                      SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                      SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\Desktop\Setup (1).exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                      Category:modified
                                      Size (bytes):93286720
                                      Entropy (8bit):7.999992866036175
                                      Encrypted:true
                                      SSDEEP:
                                      MD5:F748BC5CB1445E361CA987ED89BECABA
                                      SHA1:37F2F9C8A9D311F400A72D336D14FBDC7A3F4848
                                      SHA-256:C859968DCBDDD7ADC427CE5AC1A4B8A86D95D9F5735FF97C2EE98F2E81F5FDA8
                                      SHA-512:101E24D5D825D801FB652107C8F9D230295D1184F84F9EF2E591E6F5E1FF9D54EB6FF178A218C02D08961C5A9064DE71AA18873E23313B19F067286C33AF5303
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 13%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ...........@.............................................HO...........G..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):317200410
                                      Entropy (8bit):6.93938370854609
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:94D1DBEE20A086617EDA7746FF570972
                                      SHA1:E6F5F70A5E5F31EC410324A60BF586890A10666B
                                      SHA-256:7F44001AC11E45856C5EC6D3FD114076BD7E873AEAFC315FEA5629FBC76BD909
                                      SHA-512:8EA604751E1BCDD389CDE5742B3E9D7F5267FA08B1A2DA7CDB70114158A0CA403E57C22A7E988E028835BFA55536941B6DF032B6D3655E12E597CCAD7A44E717
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........,.......,.......D...............t.......r...............................................................K...........................................................................................................................................................................3...............W2..................................................................................................................................j.......................k...................................................................................................................Q.......c...................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):114
                                      Entropy (8bit):3.9186186502386113
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4CCD71080E0B3BF3BB573B303FF72D78
                                      SHA1:AEED3686A71BD61DF670349DA2F018C63A0731B7
                                      SHA-256:3E33607355ADAF4F71654CF88B0C11DA3D5675B2C6DC327AD397AEE0681949E4
                                      SHA-512:3EC7DD6BA6B72928C4AA38698AF6A92E381815B446B22AB12713AAF73A524D9E6979A9B2AC691DE8ADF5987C5F80D2170D8BBDDA1843B465D80114A4746E2BBB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:DAPC............%ZB..D~O...........).....qf............................e7425a25-44d0-4f7e-9000-180507e9b50e.dmp..
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:Mini DuMP crash report, 13 streams, Tue Jun 18 16:15:03 2024, 0x200000 type
                                      Category:dropped
                                      Size (bytes):2270800
                                      Entropy (8bit):3.869953594594404
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:369EA7EA39302D00D943A3F65D8CC369
                                      SHA1:3F8B6B301D10157F9C01E1526B25C2CA81DBA56E
                                      SHA-256:D3D286422DBC5F75B6CDF8295ED1B6B23E7A3F4CA317E4F086B4334A682B931F
                                      SHA-512:D9A63FDE456E6A8251A7B79300A39E6BF8F183A9664386133AB71F88F81C42BCC879DECE6374C005A792A6D08BDEAB9FE703F1CCD07780462EE24821DBC9074A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:MDMP........ .........qf.. .........8...........T...............X...........p...........`........#...............A....PC@....E...........J.......L..l'....kKF....u.......v...v....kK).......................eJ..............L.B.........................2.0.0.6.....T...G...X.....qf............................................,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................W.i.n.d.o.w.s. .N.T. .1.0...0...1.9.0.4.5...2.0.0.6.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):40
                                      Entropy (8bit):3.39546184423832
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:09D7A58BA8FFAEC83ADDCEC5295399E1
                                      SHA1:FCE301891588EC8276483F7704EA02516ABE623E
                                      SHA-256:2D7E8434A7261D0007300CE29127BDE4CEE4CBADA61CA1B394C5E7156E672C92
                                      SHA-512:5EA3B24DE4FC65DD0271C0C663DCD1B9ADD7DF46DE69BDAA6462D262C68AB4B4C6FDACF579653490EEBC4A16B7BFE8CA3777B644977C0A0E1205E21448BC0BB2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:sdPC....................i..Yg..K..&.`..
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                      Category:dropped
                                      Size (bytes):151668
                                      Entropy (8bit):1.0550957398929903
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:728FE78292F104659FEA5FC90570CC75
                                      SHA1:11B623F76F31EC773B79CDB74869ACB08C4052CB
                                      SHA-256:D98E226BEA7A9C56BFDFAB3C484A8E6A0FB173519C43216D3A1115415B166D20
                                      SHA-512:91E81B91B29D613FDDE24B010B1724BE74F3BAE1D2FB4FAA2C015178248ED6A0405E2B222F4A557A6B895663C159F0BF0DC6D64D21259299E36F53D95D7067AA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .V....M..(............. .........................................................................................................................................................................................................................................................................................................................(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):48
                                      Entropy (8bit):2.913890986728064
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BD9CF4B8FCC885796FD5B6040196981E
                                      SHA1:E1CEBEA3C7D334CA71BB2162FA33A1E5B86F9289
                                      SHA-256:26B116A10285289CFC3F8AFAEFB0DCC172CF01004610D0E36A11CA13BA087768
                                      SHA-512:03C09A4FB156AEFEAFEC0B1D4F35D08612E1520A98F552A57F584F1FE20E206AEE7BBD824F139262AEA1523A07256A6EC58EA9E043B103861ACE64542110DE9D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:(.....t.oy retne........................<.!..y/.
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):48
                                      Entropy (8bit):2.955557653394731
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:07F980EEF02A362F087C0739C11D70F2
                                      SHA1:1F5E56E0C6570C27659CC270E003F3E206EDD51B
                                      SHA-256:B7ADAE9F5340D79DA2C5260BB1F7779C8C4008DA2478EC4F78CF8F4F2C32A142
                                      SHA-512:3235951A02C57A544BADC2050471E1895E23FE8E49DF1A05597C9AC5608E16CD0366A9146468D5788446E74DE10659BD50437EAFCD4AC46795DD8A6CB76958AF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:(.......oy retne.........................A...y/.
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):0.011852361981932763
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0962291D6D367570BEE5454721C17E11
                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                      Category:dropped
                                      Size (bytes):262512
                                      Entropy (8bit):9.553120663130604E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F419D6F96C9C7B22EE5F76B6446225A0
                                      SHA1:9B3C105FBDABAE81155A9A4539E8E2C631076BCB
                                      SHA-256:C5B701F6B0023C4F625C8868A69C43E7FD0BB6A19D0347ED8D0DD3737008BC5E
                                      SHA-512:36972F50548D13CBACEF8547C21551A3A1AE79E368977348896F95E9B3908B4F961FEC013C5A7C1E64FAABAB11D587A80A4715E34EA68E7B9AF3EBD536736850
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..........................................B..y/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):0.012340643231932763
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                      Category:dropped
                                      Size (bytes):262512
                                      Entropy (8bit):9.553120663130604E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:83E734D91725E033E7BDA08AF1790592
                                      SHA1:372DAC2550C025886BAC4DE920D2D323C67F4950
                                      SHA-256:25768FA0DB3368B6DCA38CC4641452CFCB3458623DF9611BE44879BAA0E30137
                                      SHA-512:A09B4B8AEF7E1FCEDBE2BE971D89D43A2DB45F6D0AEA6CEEDB6A9955A45032D7BCD467A301813AA72478E148B982202D577210F768572697C5F4A796A529309C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........................................4_...y/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):162
                                      Entropy (8bit):4.273886413532386
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:44028E0E05F8498268AA16B5D1BF19FF
                                      SHA1:1C241C407F2903727920B5069C4582F5D33369C8
                                      SHA-256:2952D4AD35DC8E19F3D10CEFA90B832EB3923B88C472A22F6FD57D4A5CF84E74
                                      SHA-512:A8F677CFB8EB25A8A8287AB2ADCF72932FF9AEBFC54EACF55034342BFFA10A212C487B11895C005605737569C24800F5EA82AA9A3FDAED10FD084E897A8FF2C4
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:nwjs settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through nwjs defined APIs.
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):48
                                      Entropy (8bit):2.9138909867280645
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BD5A2A5A9E5A31D2F5DE0170FA0A9FAA
                                      SHA1:8B1995603421E9A81A7939F8B1092AFC18D066B9
                                      SHA-256:4CEE03379045800C15C27AAF73E515B324A789C6A1800B480C1263BCBE660523
                                      SHA-512:BE1605B3C44FBD02954C452C5E8BFA37874D6C5296A704693C398EF5213C7C35B1DF59B5AD27E65A5CF56D94E564A938F14E6CC867576206A7EFAD8080868C55
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:(...K...oy retne.........................YD..y/.
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):270336
                                      Entropy (8bit):8.280239615765425E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                      Category:dropped
                                      Size (bytes):262512
                                      Entropy (8bit):9.553120663130604E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:91EC85F7D4E80BD36D014E0C5353009F
                                      SHA1:CB89F26ABA17A502946C737B514E53CBE4BA5668
                                      SHA-256:75DA1497920692D23F1BC05EE4EB737B8426A31FCE9F17A8914057F8139252C2
                                      SHA-512:3CE90291C98AEF08553F24CE463664D13CA5774DC28E9D327922875F8C401F6213A04F324C363F9C808FD119E280689DB5C3FC0625AA54B6D2C0A3E224B7AF5B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........................................C..y/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                      Category:dropped
                                      Size (bytes):262512
                                      Entropy (8bit):9.553120663130604E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:ADC1413537818D4FD9463BA9667DED4F
                                      SHA1:8A3783B579DE765A7E913916ED98EE866759BF59
                                      SHA-256:D9F7A81F00D58A8AAA87C0AB711FE0CB53AC914D0B820799BD76606969763196
                                      SHA-512:63C01AF5FB68DE860DDBE1510860231209E59E9DD232D25A27052220474495DC5D1E198F6C44237B76F0C24FE2F6075F568FE05BE235FDDE243BE3E2486E2B6D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........................................~D..y/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):13
                                      Entropy (8bit):2.449311833026446
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C47A31A2D1E34FDAAE277778AF22D0E3
                                      SHA1:89F03CC294CEA7FC0F34DBEEC269A19BEEA63D11
                                      SHA-256:8A99621DC938B98F703F2EB11DF24982287DB9C2BAD487CAFDE8AC18FA876CD6
                                      SHA-512:E78045BF4071EF3BEE1E2E1B1F9428E14D0FCC56E04E66492C2E523974DDAC4A883C8A5016D571CBFCB9B5B69003B5671C248A3EFA4DF1D12CB9AEAA9BE9DFA0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:122.0.6261.69
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                      Category:dropped
                                      Size (bytes):8192
                                      Entropy (8bit):0.01057775872642915
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                      Category:dropped
                                      Size (bytes):262512
                                      Entropy (8bit):9.47693366977411E-4
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:9A9ADEC41FF07E8ACC4075F261DF66CF
                                      SHA1:7AA1EAFC2AD708A548605B171D113A736661C0D5
                                      SHA-256:28A8B0B1CDD5CC66E1E0602FBDF9FF9161D1820FC08764731713595AE79B8992
                                      SHA-512:7F474B5727F3676B311C534E90F6EE8F2FD8C2FEF5A21828F626E9D1ECAF949ECFBA6AD38E557A5D86F1C5B8EAB75EDB85BABC3AE7BBD426FB455EF1AA500D42
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........................................s..y/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):921
                                      Entropy (8bit):5.631380518068421
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CA119F6D203E7E026E0BB7807CEFEA31
                                      SHA1:02DC8FA1AD0D5D68A97DBEFA8EECE4A3C7D2FBCE
                                      SHA-256:2DAD2E080BBB3F4B2259B478377778F59857D4390440E9D826ADFCF2D6CD2302
                                      SHA-512:94D0453418A7B429012C79638C8CC4A3A6C390D0E15EEEDD0C407AF189BECA70C4BFF62A801EE69F9954FCBAC330AABFA637D9DBC684DA3464C4F010AC68FFD7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADaOBY8wUtcTY2BpQlL0/BWEAAAAAoAAABuAHcAagBzAAAAEGYAAAABAAAgAAAAwkXpVzhp4RlFitK47o6AB6o1lB8gEeRXouXA0uyPOG4AAAAADoAAAAACAAAgAAAAfbecy5vTAbRo4fQnZyUDNbwa+O/2Kpswk8X0nrh2FLkwAAAAtXaJF8ilyPx1l2+fVhfD76fJZgQkfjoh+buOef7NCXkU63Or0/XAkYQYJIdpjP2PQAAAAIoTlBai1z4zzCjdd9EfOR88EjBp2rRUA1m5SgCF9SyzftUKiiPlG+KOwBmJohaFSUoDyqctSIPNKTkJgZn0mAY="},"profile":{"info_cache":{},"profile_counts_reported":"13363200903266595","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1718727303"},"user_experience_metrics":{"low_entropy_source3":4910,"pseudo_low_entropy_source":1778,"stability":{"browser_last_live_timestamp":"13363200903213107","stats_buildtime":"1683435600","stats_version":"122.0.6261.69-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"9"}
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jun 18 15:13:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2673
                                      Entropy (8bit):3.9886962260487464
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D86B2F4F19C45554B7A9BD46DB772D6D
                                      SHA1:27D7323DA070BCBA5C97231DC41AB5139E845B3F
                                      SHA-256:8465EE5F9658953E6B08F8A1AC76874C27A86CF3077BA842EA11E373C05772AD
                                      SHA-512:15AFF79E2027BFE0752A5425CA971ECE0091A8D9604D975B0EE4702E19DFD3CDF6C51E78A696B425A8E7DF6E509BCCFD0D22092D50D44724971B710CF6073620
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.....$ n....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jun 18 15:13:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2675
                                      Entropy (8bit):4.005225452118071
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C11D265154A76A6876B04CB0B4341396
                                      SHA1:4349D19793FE86F73185A48DED8690CC4E44E9B9
                                      SHA-256:0174B478AEDF968CB68982CFF0CF1A1076DAE8480FBEB540DEF55BAACFAAC298
                                      SHA-512:43DB4E6ACB1EBCAF34D75DB4673E6E8FDAB7C111D1D8B65182CE5440D54B5A2FDB16A91620B5A02530EF4C0B9B62E38932412DF2D9FC5DF780B687AAEDF148B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,......n....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2689
                                      Entropy (8bit):4.01363865280805
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A1821C9D8C301C8ACFA1C744441655E2
                                      SHA1:3E55A39AC04679A788DC4BF19672E8952A1345F6
                                      SHA-256:D8A6085F06B36A2634B32F7445D57EDD70899E4B9CA68BAAF02A385D4D1AB4E9
                                      SHA-512:0C9FDDE5C5419ABF4F6DD91DC0C244D5EFE53EE92F88D04D30499ED47A4AC6405C107F2227E0CA6F4AE96645CA3FEE9891846299B00DF3819AF3563189EF69C7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jun 18 15:13:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2677
                                      Entropy (8bit):4.005526812661097
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:79270B21C3F88D9F6E039962AF29A9C8
                                      SHA1:70EA5F229510FBF5C167699BF20833999D06F613
                                      SHA-256:5FF316F8A10E49F7650F86807D652A86154875DF1968F00D1DB766B10F8F175C
                                      SHA-512:1F0708A6AC5F04BE62F008AA32D9ED1D763F511093B86B0E87A6B9142E34B65EF0C6F960AB2B8445B604DE791E4467BAFE35B0500B5CE8C4F5C0F60B9F0FB9AE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,....H..n....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jun 18 15:13:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2677
                                      Entropy (8bit):3.9922358360142898
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F999CA26B6B231951FFD69318F996CF2
                                      SHA1:1713D49956143C306DA4BBCFE4CE7BAB7DBB6FC4
                                      SHA-256:D3459F096798A1E03230C6A5FD1C616500DDEC43BA1F11B28B348EAB8BE013B8
                                      SHA-512:9DBCB788104F0717DFB1B399007CCED8DCD1D3ECE817B6D9DEFF06DD2F376DF358457FFBD1800FA0F63788B283BB3AB45B172F5141B33E5C715B9EAB7061839C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.......n....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jun 18 15:13:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                      Category:dropped
                                      Size (bytes):2679
                                      Entropy (8bit):4.002810385297114
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CC347153C2DA7D0D98E724905E48F9CA
                                      SHA1:23AF39B8EF6C698AE130F35D860F09CB7B11BA4B
                                      SHA-256:056A8DEEFEFA8FD0296C13316826DC8523CC0C7A1977C67ED6845FA3EE117E79
                                      SHA-512:B75564B86EA0B79951BBCC2D50565245F1CE1711CC7ABF36D0D03FDDD69E9982834E2608FEE5568A3CCB44FDA8BE33A76DF28F349DFEFA5987DB97B32F9948D6
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ...$+.,.......n....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Apr 30 14:50:30 2024, mtime=Tue Jun 18 15:14:51 2024, atime=Tue Apr 30 14:50:30 2024, length=2123104, window=hide
                                      Category:dropped
                                      Size (bytes):1852
                                      Entropy (8bit):3.474187676711416
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F30DBEFF0BD85BFFEE56E72183A4C928
                                      SHA1:1DECB4D4AC2F87934B6CF633850AA2520DB02AA2
                                      SHA-256:12527A193BA19F5B4015B44A9319A411D030D114A61DEDC520E51C3746DD941C
                                      SHA-512:2E6DACB921D4EC47EB24E2EF492D40A2CC200A26770FDE7ADEDEA4BBF3DD24933D9468C93BA7691FAD3504E5728B58CC98DCC88E2D00A830EBBC1109AD3BE95E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:L..................F.@.. ....gqCr.........gqCr...`e .....................0.:..DG..Yr?.D..U..k0.&...&.........{4..../......c...........t...CFSF..1......X...PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F.......X..X...........................~...P.C.A.p.p.S.t.o.r.e...D.j.2.`e ..XO~ .PCAPPS~2.EXE..N......XO~.X.....L.........................P.c.A.p.p.S.t.o.r.e...e.x.e.......V...............-.......U..................C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.c.a.l.i.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.'.C.:.\.U.s.e.r.s.\.c.a.l.i.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.............................................................................................................................................................................................................................%.U.S.
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):437600
                                      Entropy (8bit):6.493359962806345
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E53771D986BA5BAA64D6C8EBB8E0CCB4
                                      SHA1:7824357CB2A31EAD5DCC8A5249B1EEA7BE916061
                                      SHA-256:3302904211C8CED319E83D9C99482D6CB58D30B8AFC80C8EA7E31520525096C4
                                      SHA-512:E0B237D7F7FBBD557C825842BD162C0E44E55FC0B9A3FC0DDE527E7555933D5F3964870AC8C817101C08FB5E1759C30DC51D6083EFF38A0C8C4247A49F8E73D9
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 18%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+t..o...o...o...$m..c...$m......$m..y...zj..~...zj..y...zj..8...$m..|...o.......W...m...W...n...o.h.n...W...n...Richo...................PE..L...~.Yf...............%............v.............@.................................t_....@.................................l........0...G..............`).......2..x...T...............................@............................................text...;........................... ..`.rdata..............................@..@.data....+..........................@....rsrc....G...0...H..................@..@.reloc...2.......4...P..............@..B................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):2123104
                                      Entropy (8bit):6.393422098200928
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FCEFC6099C1265E7F7B703C7A0154C5A
                                      SHA1:84F13C7724E24A4416F3D65C143F013D9E9DFCFC
                                      SHA-256:4A223CF0623913C903CFC2C0A1A8450405244D8B86C1020E970CBDF8E7A30184
                                      SHA-512:D4D1A0D781CA851C9738C5981F13EB023092CE71E0CD04B3ED8DCC942A8ECE54B9A031230E300BBDAA4486792F75AF768FDBB882B430F5915BEC85BCC66CF3F5
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 25%
                                      Reputation:unknown
                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........O.:..pi..pi..pi.Vsh..pi.Vuh..pi.Qth..pi.V.i..pi.Qsh..pi.Quh..pi.Vth..pi.Vvh..pi.Vqh..pi..qiQ/pi..th..pi..uh..pi...i..pi...i..pi..rh..piRich..pi........................PE..L.....Yf...............%.....0......>P............@...........................!......O!...@.................................d...|.......P^...........< .`)...P .......p...............................@............................................text...\........................... ..`.rdata..:...........................@..@.data...D".......z..................@....rsrc...P^.......`..................@..@.reloc......P ......|..............@..B................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):276832
                                      Entropy (8bit):6.136449365837954
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5E28DD3006A64174FF0F82469540712E
                                      SHA1:803B328A407AA6799A86B3555C55B5B29C0B01F1
                                      SHA-256:D3ED2CD4C44B76CFEF67934280F5952CCA28A66E096F87F05B6EA1A64EE3F7AC
                                      SHA-512:FCC3B6A708FB0ACF083DA0CA853B3560D62EE2F23238B1D1D7BB9B93E4EE5DCDBA29D41B9043AF55C8168C3AC865B4A747B79C1FD5EA573169EC155E376A0AA9
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 8%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X.L.6.L.6.L.6...5.I.6...3...6...2.F.6.Y.2.\.6.Y.5.E.6.Y.3.s.6...7.A.6.L.7...6.tF3.N.6.tF.M.6.L..M.6.tF4.M.6.RichL.6.................PE..d...y.Yf.........."....%.............*.........@.............................p......~z....`..................................................w..x........H......\1......`)...`......p?..p....................@..(...0>..@............................................text...@........................... ..`.rdata..............................@..@.data...|&...........z..............@....pdata..\1.......2..................@..@_RDATA..\...........................@..@.rsrc....H.......J..................@..@.reloc.......`......................@..B................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):146
                                      Entropy (8bit):4.577360416859904
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2845450EA9D938CFEA9809CA0C827F12
                                      SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                                      SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                                      SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):1717
                                      Entropy (8bit):5.219561169695302
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2F5ED2B6ED2601E7FAA6AF3816B7E961
                                      SHA1:95DD83BD276F14E6A52AF84A96C94E52EE3D386C
                                      SHA-256:85B7D19857B742FC8BBBB86831A74A9C4FEE6BD2944392C0639197905B84E19B
                                      SHA-512:E838CB22A8763D22BFCBF274D609FD9A764A4D1773E236ACA856D33D9C48741966FBF2BF95C43EFE29F102D07D37FE9B753CDCF28983CBDD9E6755604BFC41F3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"98","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"4","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"TY8GD","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OPG9ENKS+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20230522000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Microsoft+Update+Health+Tools","6":"Office+16+Click-to-Run+Licensing+Component","7":"Office+16+Click-to-Run+Extensibility+Compo
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):73
                                      Entropy (8bit):4.089026662492467
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3024A54E0C352ABE5EB5F753CA4828DA
                                      SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                                      SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                                      SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                      Category:dropped
                                      Size (bytes):93792
                                      Entropy (8bit):6.886743197387273
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:380AC3CDDCA19D9B76384E61B55ED3F5
                                      SHA1:8C4FC8267A6B1AD3E8379467A68BAEC7B0613327
                                      SHA-256:1C99CD4EB15F84B59082BFEBC75B6EDE64B084BFDFC490722B8A58A94BB11141
                                      SHA-512:162949512DD9B534A8B8E108A2FBCD1AC028A4FD3EA6DE484FEDFB1A9345ACA7C6918385C36423A92465E2F91D52F2419970C4CC71A3D1ECED49352F2DF6C970
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 58%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO...........E..`)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):2312704
                                      Entropy (8bit):6.449649685576397
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E472E46BDFD736351D4B086B4C4CA134
                                      SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                                      SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                                      SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):9560433
                                      Entropy (8bit):4.8475056659478915
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7A32B7C762C76BD3EE38E3E998705899
                                      SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                                      SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                                      SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):4916712
                                      Entropy (8bit):6.398049523846958
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2191E768CC2E19009DAD20DC999135A3
                                      SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                      SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                      SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):2028032
                                      Entropy (8bit):6.64708834859118
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5FFF6F0423A38BFAF174CB670650F4F9
                                      SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                                      SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                                      SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):10717392
                                      Entropy (8bit):6.282534560973548
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                      SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                      SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                      SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):454144
                                      Entropy (8bit):6.3485070297294985
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7255FCCD39F330CA2123F380B4967E0A
                                      SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                                      SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                                      SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):8058880
                                      Entropy (8bit):6.448026576223661
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                                      SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                                      SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                                      SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):502905
                                      Entropy (8bit):5.409605383978337
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                                      SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                                      SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                                      SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):813426
                                      Entropy (8bit):4.915984741122479
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                                      SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                                      SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                                      SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):822020
                                      Entropy (8bit):4.925237393732045
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:621B390B8AF0C70D682715323A92B61F
                                      SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                                      SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                                      SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):897122
                                      Entropy (8bit):4.928723053414015
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                                      SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                                      SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                                      SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):927865
                                      Entropy (8bit):4.686646990438899
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:27C55B97D549BCF13145EC75F0A503CA
                                      SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                                      SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                                      SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1193463
                                      Entropy (8bit):4.299730648702171
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7351AE61AE5884088AE68CE5BE0043D8
                                      SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                                      SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                                      SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):573774
                                      Entropy (8bit):5.391859865204477
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                                      SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                                      SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                                      SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):583431
                                      Entropy (8bit):5.838398613999325
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7F1AD2897B210C4C25CFBDF0736F6809
                                      SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                                      SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                                      SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):530651
                                      Entropy (8bit):5.44607278354406
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:9D6A98D53208092F687AD7BB3DBAED7D
                                      SHA1:161D0689CA85147B356167F98EAD84783E331986
                                      SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                                      SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):571551
                                      Entropy (8bit):5.489447532911186
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:851D55585CBC90143DD4C70EB4900574
                                      SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                                      SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                                      SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1016551
                                      Entropy (8bit):4.766567786580532
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                                      SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                                      SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                                      SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):459985
                                      Entropy (8bit):5.5152848417450615
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                                      SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                                      SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                                      SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):464664
                                      Entropy (8bit):5.505055040425703
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4B6300C27E7575C32888C1F3364D5346
                                      SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                                      SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                                      SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1031027
                                      Entropy (8bit):5.210875521790238
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D5A14353A7FCC1F199F9234BD4551FF9
                                      SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                                      SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                                      SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):560321
                                      Entropy (8bit):5.366866302767652
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:AAB525A7681AE93791B283205064E2B4
                                      SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                                      SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                                      SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):559178
                                      Entropy (8bit):5.34611084339133
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:078BD56804D26C26E9AA4F41BF6549F6
                                      SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                                      SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                                      SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):509452
                                      Entropy (8bit):5.455817407928288
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:45E28E64378FABED845EB242A8F1563D
                                      SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                                      SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                                      SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):825360
                                      Entropy (8bit):5.0557125829631335
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A13029CB1D5873121E6BDD0929A6C772
                                      SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                                      SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                                      SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):517467
                                      Entropy (8bit):5.424845538875905
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E7B72F44D711DECE8E3043173A553AC4
                                      SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                                      SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                                      SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):584976
                                      Entropy (8bit):5.195604084490558
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F7F3CC17509AF03E639E983A091C2026
                                      SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                                      SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                                      SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):606342
                                      Entropy (8bit):5.380118288987104
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:326917C8F37FE85E58AD3DE991D17A78
                                      SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                                      SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                                      SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1177779
                                      Entropy (8bit):4.338116428198543
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                                      SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                                      SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                                      SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):728589
                                      Entropy (8bit):4.658856122190603
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                                      SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                                      SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                                      SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1250127
                                      Entropy (8bit):4.3103395858193565
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:114BBD0D21C90DDFCE1D6E26432B7B9C
                                      SHA1:EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
                                      SHA-256:E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
                                      SHA-512:6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):562949
                                      Entropy (8bit):5.503469092776888
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:54308E58D399D0F1C4E66A4A4B6E3B59
                                      SHA1:8DFCE74D45801654531C78E34CF6A6C2E4BA5556
                                      SHA-256:8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
                                      SHA-512:33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....|...........'.....T.....d...........T.......................Z.....|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....|'.....'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):605952
                                      Entropy (8bit):5.638270541961174
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B7AA52653BBABCC713A03067E6FCFCC3
                                      SHA1:B18CC0B968C4C0F156E33F5C493E6C09760161DD
                                      SHA-256:244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
                                      SHA-512:CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[*.....*.....*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):500354
                                      Entropy (8bit):5.374540321275158
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0EFA0011CE0365AE4AFC08753F559098
                                      SHA1:6AFC5115DFC222F0F2B2265A591B571803787DCA
                                      SHA-256:A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
                                      SHA-512:21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):558299
                                      Entropy (8bit):5.272942823509238
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:12FFE0FC0BE1B4134F219BD3B6D8F550
                                      SHA1:DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
                                      SHA-256:4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
                                      SHA-512:423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):677279
                                      Entropy (8bit):5.7261443457831875
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A92DA679A63FB99BB5F3BCF829168D21
                                      SHA1:F15AA9BA6A952490DD881C82DED179FE03E50E80
                                      SHA-256:F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
                                      SHA-512:3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A.................*...........d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....*$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....).....*.....*.....*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1341496
                                      Entropy (8bit):4.250874916501427
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F13C1631BB1E180C07CB10C5142CEC74
                                      SHA1:BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
                                      SHA-256:3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
                                      SHA-512:9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r*.....*.....*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....|X....IY.....Y....\Z.....Z.....[.....\....]]
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):569413
                                      Entropy (8bit):6.084713993678112
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E8448C3D352C76C1C0F2B9F508852D9A
                                      SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                                      SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                                      SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):611429
                                      Entropy (8bit):5.6299671018290445
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                                      SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                                      SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                                      SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):610750
                                      Entropy (8bit):5.626685122127425
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8D8244CEA7D00E7502CFC62908147BB7
                                      SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                                      SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                                      SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1394062
                                      Entropy (8bit):4.285571867304228
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:979090995F7F9DBFA9FA9A96349DA745
                                      SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                                      SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                                      SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1147816
                                      Entropy (8bit):4.319695697825778
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7862ABEC5008FAC0A8924B65B3058C05
                                      SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                                      SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                                      SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):524044
                                      Entropy (8bit):5.251286724342732
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                                      SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                                      SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                                      SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):508553
                                      Entropy (8bit):5.428763068409714
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:40B668B73BBF3575D009F3D528D388E5
                                      SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                                      SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                                      SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):525362
                                      Entropy (8bit):5.366124885898627
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                                      SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                                      SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                                      SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):587942
                                      Entropy (8bit):5.759897632158159
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2D6468A89698A05B8522F679825572D3
                                      SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                                      SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                                      SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):551569
                                      Entropy (8bit):5.417670979179483
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FBD585195E35E49C60A9190FBF815E86
                                      SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                                      SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                                      SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):555353
                                      Entropy (8bit):5.392038775374042
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C64146716C2A401FEC538E4C79785144
                                      SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                                      SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                                      SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):574388
                                      Entropy (8bit):5.451836104471441
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                                      SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                                      SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                                      SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):941599
                                      Entropy (8bit):4.851052751447414
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:36D9CBBB31930EB5B78378EC63751BE6
                                      SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                                      SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                                      SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:CSV text
                                      Category:dropped
                                      Size (bytes):1051021
                                      Entropy (8bit):5.4211132061857965
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                      SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                      SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                      SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):592404
                                      Entropy (8bit):5.807054231111397
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:59822645439846B0A211C8566E7CF90E
                                      SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                                      SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                                      SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):568760
                                      Entropy (8bit):5.4785168337779435
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:970F310ACBAFA4A29E0CFA5C979DF397
                                      SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                                      SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                                      SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):872667
                                      Entropy (8bit):4.788135484665425
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5E439D9D281D90569CD4AA231FC8B287
                                      SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                                      SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                                      SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):512705
                                      Entropy (8bit):5.538975019723545
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                                      SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                                      SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                                      SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):539452
                                      Entropy (8bit):5.338235032300934
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F0314E8F5AF94C845AB4218468AF3454
                                      SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                                      SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                                      SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1387366
                                      Entropy (8bit):4.061553280377292
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4411E4698E279FB95ADEA7BE9625F800
                                      SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                                      SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                                      SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1281329
                                      Entropy (8bit):4.31693967998977
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:443D47F30632512C7E5A6E142D2A3CA3
                                      SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                                      SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                                      SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1076392
                                      Entropy (8bit):4.3678914271676845
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:ABFAD720A09628E229EE75C14DCC1DEE
                                      SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                                      SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                                      SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):550618
                                      Entropy (8bit):5.609493488679069
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CE85F55613C69479E13D011F0B81E3F1
                                      SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                                      SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                                      SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):938457
                                      Entropy (8bit):4.888192308730272
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                                      SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                                      SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                                      SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):817673
                                      Entropy (8bit):5.177156515939135
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3129155651C81F86E5E2794B0CD15EC7
                                      SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                                      SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                                      SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):651358
                                      Entropy (8bit):5.790776889845594
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5910DEDFBC84629690DD59478E80B51A
                                      SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                                      SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                                      SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):472125
                                      Entropy (8bit):6.686635546459109
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                                      SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                                      SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                                      SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):469061
                                      Entropy (8bit):6.698957808032297
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:687995F645CB9169DBFC3431E8FCFE3B
                                      SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                                      SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                                      SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):18401792
                                      Entropy (8bit):6.484724602010289
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6A067CB26AF2C240C240BC81C4A4F311
                                      SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                                      SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                                      SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                      Category:modified
                                      Size (bytes):1162240
                                      Entropy (8bit):6.551791881008996
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:EDF83410995BEA188731EF377334ED7B
                                      SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                                      SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                                      SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):196713984
                                      Entropy (8bit):6.709853681888895
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0B9A2D445F28B403D525380817A2636E
                                      SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                                      SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                                      SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):685745
                                      Entropy (8bit):7.962986984739525
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                                      SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                                      SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                                      SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1079219
                                      Entropy (8bit):7.95049008504143
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                                      SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                                      SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                                      SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):1134592
                                      Entropy (8bit):6.555043286804751
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:364F839CA8DE4D942270D9097D48EF15
                                      SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                                      SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                                      SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):4656369
                                      Entropy (8bit):7.995866504972196
                                      Encrypted:true
                                      SSDEEP:
                                      MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                                      SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                                      SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                                      SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):686733
                                      Entropy (8bit):5.111423885670035
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E68978443DDAFD40434C87818C90D338
                                      SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                                      SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                                      SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):4483072
                                      Entropy (8bit):6.30617269058202
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:DB64B157590C89B63D7E7FCF97FD7A01
                                      SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                                      SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                                      SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):106
                                      Entropy (8bit):4.724752649036734
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8642DD3A87E2DE6E991FAE08458E302B
                                      SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                      SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                      SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                      Category:dropped
                                      Size (bytes):918016
                                      Entropy (8bit):6.582669085817742
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C59EE747C59CD7B450DB71FD836E7153
                                      SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                                      SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                                      SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: ReversingLabs, Detection: 0%
                                      Reputation:unknown
                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                                      Category:dropped
                                      Size (bytes):16958
                                      Entropy (8bit):1.8361199320851
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:815665F58B066A42DE47F55ED686D184
                                      SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                                      SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                                      SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):1303
                                      Entropy (8bit):4.930056154273335
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E9BC8012CD99DD24BDB60011424F04B1
                                      SHA1:B8C553791AAFDC77431A0C78A6A559244E57CA77
                                      SHA-256:A3375BACB5E83152D995738F4F1C6E0B30D49AC778B956BAE677B0D1E3B5C71E
                                      SHA-512:FA7E6FEFBDB4C59A3931A22AAB3383591C675B6C60A46341F16800C07ED37D38A1F0CE9A38B1EC57FE38BF7A7C8C0648E89D7D3757677BC19AB1CF13149F1B46
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{. "files": {. "main.css": "/static/css/main.2f7897e0.chunk.css",. "main.js": "/static/js/main.186cd3b6.chunk.js",. "main.js.map": "/static/js/main.186cd3b6.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.0e8f1429.chunk.js": "/static/js/2.0e8f1429.chunk.js",. "static/js/2.0e8f1429.chunk.js.map": "/static/js/2.0e8f1429.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.2f7897e0.chunk.css.map": "/static/css/main.2f7897e0.chunk.css.map",. "static/js/2.0e8f1429.chunk.js.LICENSE.txt": "/static/js/2.0e8f1429.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):278
                                      Entropy (8bit):6.614793808897997
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                                      SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                                      SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                                      SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):506
                                      Entropy (8bit):7.41701077919571
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6B5236D9B2E90E8DE0698738970AD3BC
                                      SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                                      SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                                      SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                      Category:dropped
                                      Size (bytes):4286
                                      Entropy (8bit):1.9733781811385676
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B71C63AF25F44A21143174E24791FBFB
                                      SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                                      SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                                      SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                                      Category:dropped
                                      Size (bytes):3269
                                      Entropy (8bit):5.2677457082902555
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4BA0C018DF195A2E627A8AF7AEF21952
                                      SHA1:B15EA8797084FD502500B2BEC9BEBBAD933E53F7
                                      SHA-256:C87963EECADE6524875EEA68A2B9AF5C2CE9456B44A5B8B1C5B7140D4C242CDF
                                      SHA-512:D3E24D4EEBEA57D7F8534689635BD43926F9B0A25D1BBB5764230EB642E1FF3243C7799EE4F6B6F43972EE245B0F491AD2FFD01657EA77E5B0628D389185E3C8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.2f7897e0.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):499
                                      Entropy (8bit):4.571997514321595
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                                      SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                                      SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                                      SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):2511
                                      Entropy (8bit):4.786444073109678
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BA0268049BD46633F0423F58B70A6766
                                      SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                                      SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                                      SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):70
                                      Entropy (8bit):4.431168424936135
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:61C27D2CD39A713F7829422C3D9EDCC7
                                      SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                                      SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                                      SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with very long lines (39348)
                                      Category:dropped
                                      Size (bytes):39400
                                      Entropy (8bit):5.045066158306346
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:A414BA7BFAD0ABBBC8C9F65E984B1FCE
                                      SHA1:243AB2F15484007D2A0077197DB3B07274D30D21
                                      SHA-256:895D957E77A9572F38B90CA61EC7C0DC6BEC56C8021D4E1814CE79B639D5B6AC
                                      SHA-512:5D62A71896FC8E305426745B7FBDC79A3B5F518887F0EA4C82F798771AB6A970BB220E1148C86388A66B1037B5BC8420CA0C8EE1236AA184AEE25D9C73968A27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):73736
                                      Entropy (8bit):5.1290813031073546
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4BB6854E02C1A6EDBA6A7E987F6EC839
                                      SHA1:21CA419A8D0E7CC25F990C6DA78399B76FCF887B
                                      SHA-256:BFC1C12A8FA8AC1AECE1242FDCF83C12BCEEE35FD43608C6F072C876EF5291CA
                                      SHA-512:84FBA34CD4AB97505CD813BA600E4ACA761EE75CC1ACFE02A1949DD911C8C1ED38CF38CD41CC6B642BAEADAC9DD40726863683819D7C9C76EB7BD353E8DC8330
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):673416
                                      Entropy (8bit):6.007715100140441
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:256C2960C1C6B5125CF8BE9A74EFC861
                                      SHA1:476C3A279B9B70AF869C174D177021043E75DC3C
                                      SHA-256:F7EE797420975CB738D9AB3989EF454B9DB080BDE6A186E94D813ECFC1710ADD
                                      SHA-512:01E429495544B6381BBDF9EB8738FD8BF8D9AEAA5945536108EC61D7666AB6A7238D3E752DA1912FADD799523D7236722E2837D937F802C2EAC66EAE83FC0C59
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):66
                                      Entropy (8bit):4.90372423276536
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F067DAFE94D1DB7AF2C5420C12E48660
                                      SHA1:0C8B03D660DF4D0E08E38C9D1B51A85BD797D580
                                      SHA-256:B2973036345797A370D9C05465DF1A8E42A8DD064C0508CC1761F74B093EA04D
                                      SHA-512:5163F1ADFFBF83876C039934627CEB929D7205573EA104678FCAE464ABC76B415D8F122FB56710BB4DF8A2A2BEC58E22593A33EF8D8C95EF149C3721684DA55D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:nw.Window.get().evalNWBin(null, "static/js/2.0e8f1429.chunk.bin");
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):1686
                                      Entropy (8bit):4.736390551286131
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:10A587045DF3F39CD774951756F33E54
                                      SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                                      SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                                      SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):1024473
                                      Entropy (8bit):5.4235483730669785
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BD3FF30D96539DE94E32DD93D20A61AB
                                      SHA1:477D734E087FA63CD86C4A2FAD818B752C96F5F8
                                      SHA-256:5932667EE4B9237679ACE27827C089118A7D9B10D1AA064E93AC2F0F2A1C161D
                                      SHA-512:D86E06AC5983EE00DC52DD4B52BF088CF1CE583DB15B70798EC49BA39E0969B0CA958959AF1C1A9747ECAC3499D656B9CAC3F894B8ACB5AD6755768BB4A10A6E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):16240
                                      Entropy (8bit):5.4978991340628935
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:1B83BDE47892A049925572BD77B5E3B3
                                      SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                                      SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                                      SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):66
                                      Entropy (8bit):4.8128151418562695
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B3E7D84CF0B8A2298C89F91F084C0809
                                      SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                                      SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                                      SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):9898
                                      Entropy (8bit):5.1083863257804785
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B079CA1E88F9F0249B645CF6809C0059
                                      SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                                      SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                                      SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):453560
                                      Entropy (8bit):6.148803706976676
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:DF4D42EF03D716E1CE154A767BBE689E
                                      SHA1:FB37CFB4AD1B30CB984853B98A4ED122D5FF183E
                                      SHA-256:5DC98CA0A377DECC7B00CF3C504DE12178DB1627C03673DD5CFC0DAF3F9B2682
                                      SHA-512:08A4E5BB22C009BFBB2B980C700F541BDC523F5B9031F6E02B1047C168825A8899CC1A66300F40DCCD1ED2371588D621D859B7A1BC97BD11B040DACE4D983F9F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`.....}..Q.`:........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):69
                                      Entropy (8bit):4.807213588056126
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B9E42EA626D1B2D9307A22039A9119F7
                                      SHA1:F50E8496319DEBCB394FE2E4B29B1A63D1A9ECF3
                                      SHA-256:FCF8C06F3164D308B1D71B90E32B2E390A5FF0A6AFA368A1DD73BBF7418F7ED3
                                      SHA-512:5194DC9B9A6F2CF7C6FBBFA859E653E02F28D0B410767E8E7BFDC2B561B733C145FA8050639C8B4B91FB0212A9F368C4F3F39DCDFF935ADB1D5458D10C94D4F2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:nw.Window.get().evalNWBin(null, "static/js/main.186cd3b6.chunk.bin");
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):683855
                                      Entropy (8bit):5.3628002649067525
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C258F3B874CF43D0B2F56B61EF8B955F
                                      SHA1:61F0A0E95B258FE1396D3CC6BC23ACAC945527D3
                                      SHA-256:94A3FCD71A7D4F92B3A3A24BE05661A41274D24BA7667903E49B87AFB9245BC1
                                      SHA-512:B575AA83E989DF5B7ACB8C9AD9EF0A7697BAA29090F57637D826BA9241D24F00ABB28A52C3884E5B50B2440EFF62E7322BB0F0106E875C6B2F6DBBC2479423D3
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):6880
                                      Entropy (8bit):5.780693101615468
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                                      SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                                      SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                                      SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):71
                                      Entropy (8bit):4.7442478245494595
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:07D51995B0C40EB6A7D648682400933E
                                      SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                                      SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                                      SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:JSON data
                                      Category:dropped
                                      Size (bytes):12604
                                      Entropy (8bit):5.32907166018772
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C7F90D5C550BFEECD43C415429428E79
                                      SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                                      SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                                      SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1370
                                      Entropy (8bit):5.283353360674453
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C28FE12628EAF4B73719080A13F8E1A5
                                      SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                                      SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                                      SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):5175
                                      Entropy (8bit):3.933853115875902
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:CF8666E7736704C07412232858C9CBA3
                                      SHA1:EE8666C41448498D22620353C27EB8489D763249
                                      SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                                      SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2823
                                      Entropy (8bit):4.491649868709728
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0F2E1681746D0E29CF14FE6D88B557D7
                                      SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                                      SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                                      SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):854
                                      Entropy (8bit):4.266600052838456
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                                      SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                                      SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                                      SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):852
                                      Entropy (8bit):4.275850671375772
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2CCC89303FC39BE9450730A8B415E094
                                      SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                                      SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                                      SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4743
                                      Entropy (8bit):3.9546492458044593
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                                      SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                                      SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                                      SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4729
                                      Entropy (8bit):3.9826071199242548
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7B3329DB8105F1C10A0432343AA96772
                                      SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                                      SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                                      SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1592
                                      Entropy (8bit):4.004290849514056
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D9F81AE3849F84F6F219B2831F088247
                                      SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                                      SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                                      SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1590
                                      Entropy (8bit):4.012220474436418
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4DB5D94C4F838E720E17332EDF740EBC
                                      SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                                      SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                                      SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4264
                                      Entropy (8bit):3.894045254391696
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E25CBB3FF275E58AF7891E0B857550A1
                                      SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                                      SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                                      SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4238
                                      Entropy (8bit):3.914834455290012
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2A64F22D46EF697D361BC13F4E5EC382
                                      SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                                      SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                                      SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):6098
                                      Entropy (8bit):3.8868971852897896
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8EBCB6408685047BE3BD1996D4000EE4
                                      SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                                      SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                                      SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):6086
                                      Entropy (8bit):3.9063223215918432
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:048482A7B181541A174551C016205A44
                                      SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                                      SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                                      SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):6801
                                      Entropy (8bit):3.7386877939405805
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:6DD649E7B024D0758023476637791EFF
                                      SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                                      SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                                      SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):6797
                                      Entropy (8bit):3.744755737482207
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                                      SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                                      SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                                      SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3605
                                      Entropy (8bit):3.914389459303166
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:477A237F6AE8615FA3C957919C161FFC
                                      SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                                      SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                                      SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3599
                                      Entropy (8bit):3.928807214825618
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                                      SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                                      SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                                      SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2232
                                      Entropy (8bit):3.9969278840420657
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:73CD1627E147A8EAD813AD7201D75876
                                      SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                                      SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                                      SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2228
                                      Entropy (8bit):4.011244246624798
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D4950E85D1EDD93F20A610F0B9575A1B
                                      SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                                      SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                                      SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):702
                                      Entropy (8bit):4.39074490019929
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:86893B121171A45F3494D301D57E80F1
                                      SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                                      SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                                      SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):700
                                      Entropy (8bit):4.387297248681374
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C6D2A075413FDBCB286B77A97F9B6F13
                                      SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                                      SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                                      SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3466
                                      Entropy (8bit):3.9394896115708424
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:97A4CAA52C453393A3ACEDB7EB240010
                                      SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                                      SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                                      SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3460
                                      Entropy (8bit):3.951932320279216
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:7BBD80A02464154C092ACBE7DD328730
                                      SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                                      SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                                      SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4403
                                      Entropy (8bit):3.8960426134967934
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:360145CB691391CCC038500BAD652269
                                      SHA1:4F2D87620766892151D6087962DCB08628FC1220
                                      SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                                      SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):4395
                                      Entropy (8bit):3.9130769273478307
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:B0F49189BE082A137803BEA947266CC9
                                      SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                                      SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                                      SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1858
                                      Entropy (8bit):4.054255384536267
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                                      SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                                      SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                                      SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):1854
                                      Entropy (8bit):4.069519451091226
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:FCA164880EE2E1D12B798C98241DCB76
                                      SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                                      SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                                      SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2922
                                      Entropy (8bit):3.8955256034331684
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:60F659C2639149E5FE452A99BA232B94
                                      SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                                      SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                                      SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):2920
                                      Entropy (8bit):3.895777405127468
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:610CC1A8CF2F609FCD872D217E3D4333
                                      SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                                      SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                                      SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3445
                                      Entropy (8bit):3.979453075901205
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8517A7C9AC10921DEBA471DD89A13601
                                      SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                                      SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                                      SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3425
                                      Entropy (8bit):4.01234712901125
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0C92AF8318B8C3247643257AF05FD42E
                                      SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                                      SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                                      SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.
                                      Process:C:\Users\user\AppData\Local\Temp\nsgBA2E.tmp
                                      File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                                      Category:dropped
                                      Size (bytes):11957
                                      Entropy (8bit):7.943985153985361
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:5D3291D90D252B1C09C262466D67D04A
                                      SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                                      SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                                      SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (14539)
                                      Category:downloaded
                                      Size (bytes):347558
                                      Entropy (8bit):5.585897144955199
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:1FA482113499A33E08C8CF555B3658EE
                                      SHA1:92B982276FF5FDD50930343E119BD369BE87B2AA
                                      SHA-256:BD209B4ED69E5AC1B1995DC8D1C551679174E122E0651611F7FC6841BDF5AB00
                                      SHA-512:961BA22C1DA57926E9CD293CFF1A78EF629EAABA35296A77C281B76BF0FA6FBBD3811646FCD392BC933C20134393761C41D5F45B70CD203D77DF3BC992AAA3AF
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":17},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":19},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":20},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":21},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR"
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (2718), with no line terminators
                                      Category:downloaded
                                      Size (bytes):2718
                                      Entropy (8bit):5.863509245992936
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:4C4BDC4EF3BA885040AB8F649DF9893F
                                      SHA1:2F91FCF99DC9AC2D099B671505AE08122F33F7B4
                                      SHA-256:DA0989280F004903498E54C1D68D51F5375239108C22CE94BB03A5E8DB137ED8
                                      SHA-512:C36DB6102BFC8FB81CC86E36A89309FED4021251E160D04EEEE07E885A4F5D7C06396A4551AD0143A62A414D353F5B93F57B70B0FECADF8B75D719AF037EA00B
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1718727198449&cv=11&fst=1718727198449&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                      Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (2717), with no line terminators
                                      Category:downloaded
                                      Size (bytes):2717
                                      Entropy (8bit):5.862524565543218
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:EB727CDEADA26D0D4223B4B6EC8D4F42
                                      SHA1:82652F25D6B252D962AF37A7E6342A989F8EA3F2
                                      SHA-256:C7EAE5A8FDD6B0618C74A2D43F2C90ABFE73DBCF2A68C0D1942EDD3C95EB594D
                                      SHA-512:1F0A5B084FF600D644194DB66DD95F1FD01ECDB1B3CF7CCE888700134248149C8B6460BB3C0A4B5B800B2833E0BCF0C5409BFBC63017D4F7763170BB2D46DB7F
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1718727198468&cv=11&fst=1718727198468&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                                      Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                      Category:downloaded
                                      Size (bytes):205103
                                      Entropy (8bit):5.501153363650595
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:3324B58FC6F930990E77FED788A9FAF3
                                      SHA1:0144DA58790FA1329CB5BF5CD0837D9CCBBD81F6
                                      SHA-256:561C7282EFFEAA404587031EB51535802246B305AF8E98ABC7AE015A3D01B5E1
                                      SHA-512:7F95D64000D65DE0A8D11189FF33F7BC5BB968A6FE2FEE8E67A863D3350AC2EB67F8EF1C378C0C635B0D697BE2B0F8DC03B2B36135ACFC19652EBAAA7F12537A
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://td.doubleclick.net/td/rul/858128210?random=1718727198468&cv=11&fst=1718727198468&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                                      Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1341384014.1718727198","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1341384014.1718727198\u0026tag_eid=44805651","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sjoehtg!2sZpk_IA!3sAAptDV7rvc8X"],"userBiddingSignals":[["596093288","7904705661","475816165","7904283812"],null,1718727200416882],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=158942860078\u0026cr_id=688857117722\u0026cv_
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Web Open Font Format (Version 2), TrueType, length 46704, version 1.0
                                      Category:downloaded
                                      Size (bytes):46704
                                      Entropy (8bit):7.994860687757006
                                      Encrypted:true
                                      SSDEEP:
                                      MD5:30A274CD01B6EEB0B082C918B0697F1E
                                      SHA1:393311BDE26B99A4AD935FA55BAD1DCE7994388B
                                      SHA-256:88DF0B5A7BC397DBC13A26BB8B3742CC62CD1C9B0DDED57DA7832416D6F52F42
                                      SHA-512:C02C5894DFB5FBF47DB7E9EDA5E0843C02E667B32E6C6844262DD5DED92DD95CC72830A336450781167BD21FBFAD35D8E74943C2817BAAC1E4CA34EAAD317777
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
                                      Preview:wOF2.......p......................................O......^?HVAR.g.`?STAT.8..4/l.....<..6..f.0..\.6.$..H. ..\..>..[`....|...........7o.)....C81=......g#l..PA.c.......%...$.K.....|}}....8H.\Yd.....2c.J....0K.....I..k...F..f......,L.....P...JGwj..KM....n..,..o.....n.ck...1...%.<.....;5...9..2....=b.....("4..:.k...K_...`.5v..2@...,_.3..6..@PR.]...f!X.~..b.....-..9.....?.=:kt.'@_...N...8.i......Fo..S.C.=%.........W.@7d..%......,"h...b@.DE.]l.n..(;......E.ng].`....8..C;m....).u8.....4...%..c.A.hc]....s.{.+....J..Rq...f..I;.B..g.....j.@~.........H.........:]Dc.J.6r..].".c...8j...v. M.PXB.,.v...M..NtOO.......Z`-.i..X.....".y....c.....+..e[..(..q...u..kh.k5W..=OK{.;...7...V...I.FMTWv.Dv.[..^`......JY..:.,.. tgKhC..2-...I..S..'...IL..........p......&:..(...g..B.`......%U....-.m.D.b.m..p..26.0D.....$j.r...w..z.9.)`..n.I..B...s"es...;..vY...6.T...**..2o.....W.Lu:wx.?.7..x......C..E.^SE..F.5WcMi..a..n...X...t.........6.j.j..M.9..a.....f<J.....@.&f..'.|.....p
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                      Category:downloaded
                                      Size (bytes):205010
                                      Entropy (8bit):5.502323234775783
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:37D83395B9A620A2D2AA6DFEBC4EE8D7
                                      SHA1:7635CF6F6605AD85C0FCBEDAC98530EC292902CE
                                      SHA-256:0A2D5C7610FD12323A8C0523CEE30462443E5EF7431C1A43CE2F1263031C3909
                                      SHA-512:F39633771BC3DB4FC49624145AC61741CFA79B986D4962C5913581B1863830E9FD2A1BA15A5DC4B7F11BB9558CAD4C9EF4CCE679B1E8A03153D9948E73002F7B
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://td.doubleclick.net/td/rul/858128210?random=1718727198863&cv=11&fst=1718727198863&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                                      Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1341384014.1718727198","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1341384014.1718727198\u0026tag_eid=44805651","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sjoehtg!2sZpk_IA!3sAAptDV7rvc8X"],"userBiddingSignals":[["7904705661","475816165","596093288","7904283812"],null,1718727200720651],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=158942860078\u0026cr_id=688857117722\u0026cv_
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (4179)
                                      Category:downloaded
                                      Size (bytes):271999
                                      Entropy (8bit):5.541017403397336
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:2006CC5F2BF4B78A42C61178B7B1FDD8
                                      SHA1:6C1B0CEB7232CE8837F61F86854301F441F12359
                                      SHA-256:57124AF5F432F5A2A0BF2D9B328194A54E27B8FEAE1AF5D8EEC1DB0BBE0F3A73
                                      SHA-512:E582B61F21089CB11FF5CF31ADE6256E2CE1DAFF064BB4C812787002DB74DAF84EA07709E328037BBD3F636DB7075DA3280DDAC4B63117782D87D759B42ECEDC
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:dropped
                                      Size (bytes):3592
                                      Entropy (8bit):4.71780114350715
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:0FFC071BC5AF33D2BE224CF147670471
                                      SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                      SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                      SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                      Malicious:false
                                      Reputation:unknown
                                      Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (14539)
                                      Category:downloaded
                                      Size (bytes):347584
                                      Entropy (8bit):5.586021641447482
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:BD2C219FE4D603F0A422787CAC5E24A7
                                      SHA1:1382B76DCF8B10283C87A84636C938EDF2EF0D05
                                      SHA-256:91A619FC059AB5F39BEB45A642B87F13D240E6E8BE6FA9FE6A2CB20329383C25
                                      SHA-512:EB69F9B00BF7804CE4DA455539074C5EF1EF957BA3BA23930F6AEF490216C7C9861D25AB2532802360188B464F01F03E03BD1F9AB2E814A2F8CB28FDC1120447
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":17},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":19},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":20},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":21},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR"
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                      Category:downloaded
                                      Size (bytes):205178
                                      Entropy (8bit):5.5012775757978085
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:E12B6410B1144FB6B07CF537C5AD2277
                                      SHA1:934817CEB4EA40182EE0ECD868C80B448609A053
                                      SHA-256:DA51CA9C70A6A75D3C9077EF48BF71E71CD5ED751589054901267BFFD8E99052
                                      SHA-512:E9D1445AF27B412BC6AA231C0FFA48606A5F095B25D3007A17DB632137978DC21781EDC651FBDD2624B1013FD489308F8FF69A85381F826E9F5607226F185B23
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://td.doubleclick.net/td/rul/858128210?random=1718727198449&cv=11&fst=1718727198449&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                      Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1341384014.1718727198","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1341384014.1718727198\u0026tag_eid=44805651","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sjoehtg!2sZpk_IA!3sAAptDV7rvc8X"],"userBiddingSignals":[["596093288","7904283812","7904705661","475816165"],null,1718727200384366],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=158942860078\u0026cr_id=688857117722\u0026cv_
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text, with very long lines (2834), with no line terminators
                                      Category:downloaded
                                      Size (bytes):2834
                                      Entropy (8bit):5.900991101779129
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:8B1AD01FFD06A51341BA012E16610B30
                                      SHA1:74DC33927F801C8652671ED52DF6E6F08378AE8B
                                      SHA-256:BF2C1024657A4D0EBFB95797AC15A78DFAA0717E9A34FD23904513378429E4FB
                                      SHA-512:776E8B3842BA8FBB276E3719D4266B46EE25AAB5C84ABFD8A72827DD1A5DCE8BEC69698124C10F8E45C8B66CCEE92628A840B5CA828B5514570E789C0391DDE0
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1718727198863&cv=11&fst=1718727198863&bg=ffffff&guid=ON&async=1&gtm=45be46c0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1718724052798659%26_winver%3D19045%26version%3Dfa.1091o&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1341384014.1718727198&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                                      Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:ASCII text
                                      Category:downloaded
                                      Size (bytes):2442
                                      Entropy (8bit):5.433750282812215
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:F93FFE3E7659336BDBABD70A7D00A995
                                      SHA1:24E4ACC6239D78C313521A4B3795E6B18E4DAF72
                                      SHA-256:6B8A445DBDDFB9B7C56FFD4F34B6CA628A0D2C85B6A8F4DA1EDA376694377C3C
                                      SHA-512:377BAEB23702D4EE906116BE7271D46C7A82963A1643B3A86D194242FBABDED0720FE939EC66AE68302BD910C6627F025FDB8D134A78DE41288B8A8DAF5EFA25
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                                      Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:HTML document, ASCII text, with no line terminators
                                      Category:downloaded
                                      Size (bytes):13
                                      Entropy (8bit):2.7773627950641693
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                      SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                      SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                      SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1112610034.1718727199&gtm=45je46c0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=367992183
                                      Preview:<html></html>
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:SVG Scalable Vector Graphics image
                                      Category:downloaded
                                      Size (bytes):2118
                                      Entropy (8bit):4.907323279161229
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:1039640CF0666A1621D55C9E9FA81439
                                      SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                      SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                      SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                      Malicious:false
                                      Reputation:unknown
                                      URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
                                      Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-
                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                      Entropy (8bit):7.224275176653949
                                      TrID:
                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                      • DOS Executable Generic (2002/1) 0.02%
                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                      File name:Setup (1).exe
                                      File size:120'376 bytes
                                      MD5:98bf362b34475d3757430ba89833f3be
                                      SHA1:73e7982f3df186d24ef81597e2f8b3ca1704f4da
                                      SHA256:a74f9c40ffa5d7ac67acfd5dcf93cdb351866105dfb6050e5bef181421aa7666
                                      SHA512:7eb881b10939de3b97539abcb4621a60523873dc9e1cf25368f8e570ede9a5ad0d55a58c89646262ff060f3ec114e3955efc633ad4ee4e87f15e8c776fa2b4d8
                                      SSDEEP:3072:ZbG7N2kDTHUpouUPScWxAPzy5n+/mGCKEUm:ZbE/HUMPGqry5nmJm
                                      TLSH:ECC3D05052D0D422D8A28B3079B93E779EB6DD2157709E4313107F587E7EE82A71E3A3
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........
                                      Icon Hash:45d44c7192498005
                                      Entrypoint:0x40352d
                                      Entrypoint Section:.text
                                      Digitally signed:true
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                      Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:4
                                      OS Version Minor:0
                                      File Version Major:4
                                      File Version Minor:0
                                      Subsystem Version Major:4
                                      Subsystem Version Minor:0
                                      Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6
                                      Signature Valid:true
                                      Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                      Signature Validation Error:The operation completed successfully
                                      Error Number:0
                                      Not Before, Not After
                                      • 08/05/2024 02:00:00 14/02/2025 00:59:59
                                      Subject Chain
                                      • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                                      Version:3
                                      Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                                      Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                                      Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                                      Serial:0E5C655E1CBE9A8879372F58A5BC0302
                                      Instruction
                                      push ebp
                                      mov ebp, esp
                                      sub esp, 000003F4h
                                      push ebx
                                      push esi
                                      push edi
                                      push 00000020h
                                      pop edi
                                      xor ebx, ebx
                                      push 00008001h
                                      mov dword ptr [ebp-14h], ebx
                                      mov dword ptr [ebp-04h], 0040A2E0h
                                      mov dword ptr [ebp-10h], ebx
                                      call dword ptr [004080CCh]
                                      mov esi, dword ptr [004080D0h]
                                      lea eax, dword ptr [ebp-00000140h]
                                      push eax
                                      mov dword ptr [ebp-0000012Ch], ebx
                                      mov dword ptr [ebp-2Ch], ebx
                                      mov dword ptr [ebp-28h], ebx
                                      mov dword ptr [ebp-00000140h], 0000011Ch
                                      call esi
                                      test eax, eax
                                      jne 00007F0A207EFA7Ah
                                      lea eax, dword ptr [ebp-00000140h]
                                      mov dword ptr [ebp-00000140h], 00000114h
                                      push eax
                                      call esi
                                      mov ax, word ptr [ebp-0000012Ch]
                                      mov ecx, dword ptr [ebp-00000112h]
                                      sub ax, 00000053h
                                      add ecx, FFFFFFD0h
                                      neg ax
                                      sbb eax, eax
                                      mov byte ptr [ebp-26h], 00000004h
                                      not eax
                                      and eax, ecx
                                      mov word ptr [ebp-2Ch], ax
                                      cmp dword ptr [ebp-0000013Ch], 0Ah
                                      jnc 00007F0A207EFA4Ah
                                      and word ptr [ebp-00000132h], 0000h
                                      mov eax, dword ptr [ebp-00000134h]
                                      movzx ecx, byte ptr [ebp-00000138h]
                                      mov dword ptr [00434FB8h], eax
                                      xor eax, eax
                                      mov ah, byte ptr [ebp-0000013Ch]
                                      movzx eax, ax
                                      or eax, ecx
                                      xor ecx, ecx
                                      mov ch, byte ptr [ebp-2Ch]
                                      movzx ecx, cx
                                      shl eax, 10h
                                      or eax, ecx
                                      Programming Language:
                                      • [EXP] VC++ 6.0 SP5 build 8804
                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x1acc80x2970.data
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                      .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                      .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                      .rsrc0x6c0000x4f400x50001a1ffa641428f7186726489633846f21False0.101513671875data2.760708040507546IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                      RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                                      RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                                      RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                                      RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                                      RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                                      RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                                      RT_VERSION0x708d80x240dataEnglishUnited States0.4878472222222222
                                      RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076
                                      DLLImport
                                      ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                      SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                      ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                      COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                      USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                      GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                      KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW
                                      Language of compilation systemCountry where language is spokenMap
                                      EnglishUnited States