Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1484066
MD5:7b23662026a9d97c6f3d988dc48f02ed
SHA1:856ecf5cf70b21aa5072874da63c487af223e0d1
SHA256:78a0d6001ec4e026704814c7882cf24ac825d6706d6e5f282b7fec18b2d74587
Infos:

Detection

Score:42
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64_ra
  • Setup.exe (PID: 396 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 7B23662026A9D97C6F3D988DC48F02ED)
    • chrome.exe (PID: 3460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091q&nocache=20240729092807.540&_fcid=1722243095115365 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5152 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • nsfE22.tmp (PID: 1752 cmdline: "C:\Users\user\AppData\Local\Temp\nsfE22.tmp" /internal 1722243095115365 /force MD5: 3091083F66939A0DF8DBA2D77E65FC51)
      • PcAppStore.exe (PID: 7568 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 92CC70D7D67DB4A1DFC22857920C9364)
        • explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • NW_store.exe (PID: 7800 cmdline: .\nwjs\NW_store.exe .\ui\. MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 7444 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980 MD5: E472E46BDFD736351D4B086B4C4CA134)
            • NW_store.exe (PID: 7464 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ff6a4ae8a60,0x7ff6a4ae8a70,0x7ff6a4ae8a80 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 6156 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2004 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:2 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 1776 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2492 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:3 MD5: E472E46BDFD736351D4B086B4C4CA134)
          • NW_store.exe (PID: 7904 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3120 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:8 MD5: E472E46BDFD736351D4B086B4C4CA134)
      • Watchdog.exe (PID: 7584 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240729092947.765607031 /ver=fa.1091q MD5: 7B432B3DA82D7E40916D1D2EB6F9F48D)
  • cleanup
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsfE22.tmp, ProcessId: 1752, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Users\user\PCAppStore\AutoUpdater.exeReversingLabs: Detection: 18%
Source: C:\Users\user\PCAppStore\PcAppStore.exeReversingLabs: Detection: 25%
Source: C:\Users\user\PCAppStore\Uninstaller.exeReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exe
Source: https://td.doubleclick.net/td/rul/858128210?random=1722259691299&cv=11&fst=1722259691299&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_viewHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/858128210?random=1722259691275&cv=11&fst=1722259691275&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.configHTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/858128210?random=1722259691608&cv=11&fst=1722259691608&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3DconversionHTTP Parser: No favicon

Compliance

barindex
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exe
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exe
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.0e8f1429.chunk.js.LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txt
Source: Setup.exeStatic PE information: certificate valid
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 138.199.37.37:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.173.205.117:443 -> 192.168.2.16:49826 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: global trafficDNS traffic detected: DNS query: pcapp.store
Source: global trafficDNS traffic detected: DNS query: delivery.pcapp.store
Source: global trafficDNS traffic detected: DNS query: repository.pcapp.store
Source: global trafficDNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: td.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: google.com
Source: global trafficDNS traffic detected: DNS query: analytics.google.com
Source: global trafficDNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: d74queuslupub.cloudfront.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 138.199.37.37:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 18.173.205.117:443 -> 192.168.2.16:49826 version: TLS 1.2
Source: unknownHTTPS traffic detected: 167.99.235.203:443 -> 192.168.2.16:49827 version: TLS 1.2
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal42.evad.winEXE@33/208@34/201
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nszDB29.tmp
Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exe
Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091q&nocache=20240729092807.540&_fcid=1722243095115365
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091q&nocache=20240729092807.540&_fcid=1722243095115365
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5152 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5152 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1832,i,3801908275737677119,2881359274790439296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsfE22.tmp "C:\Users\user\AppData\Local\Temp\nsfE22.tmp" /internal 1722243095115365 /force
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsfE22.tmp "C:\Users\user\AppData\Local\Temp\nsfE22.tmp" /internal 1722243095115365 /force
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240729092947.765607031 /ver=fa.1091q
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe .\nwjs\NW_store.exe .\ui\.
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ff6a4ae8a60,0x7ff6a4ae8a70,0x7ff6a4ae8a80
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2004 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2492 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3120 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20240729092947.765607031 /ver=fa.1091q
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe .\nwjs\NW_store.exe .\ui\.
Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: propsys.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntmarta.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: shfolder.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wldp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: amsi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wininet.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winhttp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mswsock.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winnsi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dnsapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: schannel.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntasn1.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msasn1.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dpapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rsaenh.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: gpapi.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncrypt.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: riched20.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: usp10.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msls31.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textinputframework.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textshaping.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ieframe.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netapi32.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wkscli.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: edputil.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mlang.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: policymanager.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpSection loaded: cscapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiautomationcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: propsys.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coremessaging.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntmarta.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiamanager.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: webio.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sxs.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: textinputframework.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winsta.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore
Source: Setup.exeStatic PE information: certificate valid
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Setup.exeStatic PE information: real checksum: 0x26a47 should be: 0x206e6
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj23A9.tmp\Math.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\Watchdog.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsfE22.tmpJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.0e8f1429.chunk.js.LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txt

Boot Survival

barindex
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj23A9.tmp\Math.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exe TID: 7788Thread sleep count: 284 > 30
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 3132Thread sleep count: 75 > 30
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 3132Thread sleep time: -4500000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7544Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 3132Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\Desktop\Setup.exeProcess information queried: ProcessInformation
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1091q&nocache=20240729092807.540&_fcid=1722243095115365
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe c:\users\user\pcappstore\nwjs\nw_store.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\pc_app_store\user data\crashpad" "--metrics-dir=c:\users\user\appdata\local\pc_app_store\user data" --annotation=plat=win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7fff3c53a960,0x7fff3c53a970,0x7fff3c53a980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe c:\users\user\pcappstore\nwjs\nw_store.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\pc_app_store\user data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\pc_app_store\user data\crashpad" --annotation=plat=win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1ac,0x1b0,0x1b4,0x1a8,0x1b8,0x7ff6a4ae8a60,0x7ff6a4ae8a70,0x7ff6a4ae8a80
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=gpu-process --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2004 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2492 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exeProcess created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "c:\users\user\pcappstore\nwjs\nw_store.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --no-sandbox --user-data-dir="c:\users\user\appdata\local\pc_app_store\user data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3120 --field-trial-handle=2016,i,18410441698466011326,14641074284539870799,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsfE22.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation
1
Windows Service
1
Windows Service
1
Masquerading
OS Credential Dumping23
Security Software Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter
111
Registry Run Keys / Startup Folder
11
Process Injection
142
Virtualization/Sandbox Evasion
LSASS Memory1
Process Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading
111
Registry Run Keys / Startup Folder
11
Process Injection
Security Account Manager142
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
DLL Search Order Hijacking
1
DLL Side-Loading
1
DLL Side-Loading
NTDS1
File and Directory Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Search Order Hijacking
1
DLL Search Order Hijacking
LSA Secrets133
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nszDB2A.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsfE22.tmp11%ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj23A9.tmp\Math.dll0%ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe19%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe25%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe29%ReversingLabsWin32.PUA.Nemesis
C:\Users\user\PCAppStore\Watchdog.exe11%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
1715720427.rsc.cdn77.org
138.199.37.37
truefalse
    unknown
    google.com
    172.217.18.14
    truefalse
      unknown
      googleads.g.doubleclick.net
      142.250.184.226
      truefalse
        unknown
        1285660440.rsc.cdn77.org
        138.199.37.37
        truefalse
          unknown
          td.doubleclick.net
          142.250.185.66
          truefalse
            unknown
            analytics.google.com
            142.250.181.238
            truefalse
              unknown
              www.google.com
              142.250.185.68
              truefalse
                unknown
                pcapp.store
                167.99.235.203
                truefalse
                  unknown
                  d74queuslupub.cloudfront.net
                  18.173.205.117
                  truefalse
                    unknown
                    stats.g.doubleclick.net
                    64.233.184.154
                    truefalse
                      unknown
                      repository.pcapp.store
                      unknown
                      unknownfalse
                        unknown
                        delivery.pcapp.store
                        unknown
                        unknownfalse
                          unknown
                          NameMaliciousAntivirus DetectionReputation
                          https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1115827002.1722259692&gtm=45je47o0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=416223017false
                            unknown
                            https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1722243095115365&_winver=19045&version=fa.1091qfalse
                              unknown
                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs
                              IPDomainCountryFlagASNASN NameMalicious
                              207.246.91.177
                              unknownUnited States
                              20473AS-CHOOPAUSfalse
                              209.222.21.115
                              unknownUnited States
                              20473AS-CHOOPAUSfalse
                              172.217.18.14
                              google.comUnited States
                              15169GOOGLEUSfalse
                              64.233.184.154
                              stats.g.doubleclick.netUnited States
                              15169GOOGLEUSfalse
                              216.58.206.35
                              unknownUnited States
                              15169GOOGLEUSfalse
                              142.250.181.238
                              analytics.google.comUnited States
                              15169GOOGLEUSfalse
                              142.250.184.226
                              googleads.g.doubleclick.netUnited States
                              15169GOOGLEUSfalse
                              142.250.184.227
                              unknownUnited States
                              15169GOOGLEUSfalse
                              142.250.74.195
                              unknownUnited States
                              15169GOOGLEUSfalse
                              216.58.212.170
                              unknownUnited States
                              15169GOOGLEUSfalse
                              142.250.185.66
                              td.doubleclick.netUnited States
                              15169GOOGLEUSfalse
                              172.217.16.200
                              unknownUnited States
                              15169GOOGLEUSfalse
                              138.199.37.37
                              1715720427.rsc.cdn77.orgEuropean Union
                              51964ORANGE-BUSINESS-SERVICES-IPSN-ASNFRfalse
                              142.250.110.84
                              unknownUnited States
                              15169GOOGLEUSfalse
                              142.250.185.68
                              www.google.comUnited States
                              15169GOOGLEUSfalse
                              1.1.1.1
                              unknownAustralia
                              13335CLOUDFLARENETUSfalse
                              172.217.16.206
                              unknownUnited States
                              15169GOOGLEUSfalse
                              167.99.235.203
                              pcapp.storeUnited States
                              14061DIGITALOCEAN-ASNUSfalse
                              239.255.255.250
                              unknownReserved
                              unknownunknownfalse
                              142.250.185.130
                              unknownUnited States
                              15169GOOGLEUSfalse
                              18.173.205.117
                              d74queuslupub.cloudfront.netUnited States
                              3MIT-GATEWAYSUSfalse
                              142.250.186.142
                              unknownUnited States
                              15169GOOGLEUSfalse
                              195.181.175.40
                              unknownUnited Kingdom
                              60068CDN77GBfalse
                              142.250.184.232
                              unknownUnited States
                              15169GOOGLEUSfalse
                              172.217.18.100
                              unknownUnited States
                              15169GOOGLEUSfalse
                              IP
                              192.168.2.16
                              Joe Sandbox version:40.0.0 Tourmaline
                              Analysis ID:1484066
                              Start date and time:2024-07-29 15:27:17 +02:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:29
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:1
                              Technologies:
                              • EGA enabled
                              Analysis Mode:stream
                              Analysis stop reason:Timeout
                              Sample name:Setup.exe
                              Detection:MAL
                              Classification:mal42.evad.winEXE@33/208@34/201
                              Cookbook Comments:
                              • Found application associated with file extension: .exe
                              • Exclude process from analysis (whitelisted): dllhost.exe
                              • Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.110.84, 172.217.16.206, 34.104.35.123, 216.58.212.170, 142.250.74.195, 142.250.184.232, 172.217.16.200
                              • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.
                              • Timeout during stream target processing, analysis might miss dynamic analysis data
                              • VT rate limit hit for: Setup.exe
                              InputOutput
                              URL: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1722243095115365&_winver=19045&version=fa.1091q Model: Perplexity: mixtral-8x7b-instruct
                              {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain any elements of a login form, such as passwords, email addresses, usernames, phone numbers or credit card numbers (CVV).","The text of the webpage does not create a sense of urgency or interest by not including phrases like 'Click here to view document', 'To view secured document click here' or 'Open the link to see your invoice'.","There is no evidence of a CAPTCHA or anti-robot detection mechanism in the webpage."]}
                              Title: APP STORE: Installing OCR: PC APP STORU We're on it, hold on 
                              URL: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1722243095115365&_winver=19045&version=fa.1091q Model: Perplexity: mixtral-8x7b-instruct
                              {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain any elements indicating the presence of a login form, as they do not request any sensitive information such as passwords, email addresses, usernames, phone numbers, or credit card numbers.","The text of the webpage does not create a sense of urgency, as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.","The title and text of the webpage do not contain any elements indicating the presence of a CAPTCHA or anti-robot detection mechanism."]}
                              Title: APP STORE: Installing OCR: PC APP STORU Balancing the app universe because balance is key to a well-functioning app store 
                              URL: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1722243095115365&_winver=19045&version=fa.1091q Model: Perplexity: mixtral-8x7b-instruct
                              {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain any elements indicating a login form.","The text of the webpage does not create a sense of urgency.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}
                              Title: APP STORE: Installing OCR: PC APP STORU Tuning the app orchestra because we want your apps to sound just right 
                              URL: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1722243095115365&_winver=19045&version=fa.1091q Model: Perplexity: mixtral-8x7b-instruct
                              {"loginform": false,"urgency": false,"captcha": false,"reasons": ["The title and text of the webpage do not contain any elements that could be identified as a login form.","The text of the webpage does not create a sense of urgency or interest.","The title and text of the webpage do not contain any elements that could be identified as a CAPTCHA or anti-robot detection mechanism."]}
                              Title: APP STORE: Installing OCR: PC APP STORU Whipping the apps into shape we're making sure theylre in top form 
                              Process:C:\Windows\explorer.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):112552
                              Entropy (8bit):4.026056980004908
                              Encrypted:false
                              SSDEEP:
                              MD5:EE898E92F8535C0E649EDF9A757BDF1D
                              SHA1:935DD99748909C53539FF309EEE79499520B363C
                              SHA-256:83EAA7EF87B10B56F092E1FD5599B0C411534EDCF620B440E1F9E31C908CE32B
                              SHA-512:EC0E35C79CACBCE3E8068CCC4705423E54E813810C88A8D47750923EB26B9574C3E43DA7BE62373FFF20801D121565E1441A0921AC43ACBBFBA974F2FA2170A4
                              Malicious:false
                              Reputation:unknown
                              Preview:....h... ...............P..............._...x...d......................].......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................... ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................c.a.l.i..
                              Process:C:\Users\user\PCAppStore\Watchdog.exe
                              File Type:GIF image data, version 89a, 1 x 1
                              Category:dropped
                              Size (bytes):42
                              Entropy (8bit):2.9881439641616536
                              Encrypted:false
                              SSDEEP:
                              MD5:D89746888DA2D9510B64A9F031EAECD5
                              SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                              SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                              SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                              Malicious:false
                              Reputation:unknown
                              Preview:GIF89a.............!.......,...........D.;
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                              Category:modified
                              Size (bytes):93300544
                              Entropy (8bit):7.999992720763301
                              Encrypted:true
                              SSDEEP:
                              MD5:3091083F66939A0DF8DBA2D77E65FC51
                              SHA1:9C43859F0F0A96EC49776B704DAD7C6AC8A7372E
                              SHA-256:268074A4D186FBED5B5F99632E09C453A38859F68775A7E77E1156C006CF894D
                              SHA-512:8BCB75C79ABD54B263EC175C4B67963980175D113B6AAB883A2157079E17B5A0ED01B825E9E08EDC6E6543339D478F84C181A0D2F23A0A92B34ECA9F7175A3FB
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 11%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ...........@.............................................HO...........}..`)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):69120
                              Entropy (8bit):6.024967061017882
                              Encrypted:false
                              SSDEEP:
                              MD5:85428CF1F140E5023F4C9D179B704702
                              SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                              SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                              SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:OpenPGP Secret Key
                              Category:dropped
                              Size (bytes):317230385
                              Entropy (8bit):6.93940854569722
                              Encrypted:false
                              SSDEEP:
                              MD5:50707CD5E1D18F778F39B17763E21CC0
                              SHA1:3D413281BD5B548F3A786E024308B7C49EE10A6A
                              SHA-256:856D30E5CD1B59BD1A6DCA526DECF32BC305AEBE0026EA7DC7579755D21FA12E
                              SHA-512:0F9C8A151444D51E2341361A0078EB1E6F1C3975337420D99A3251A3E3B93A53A1B2286FCDDA1A39EE19A0DB6C30F637678DC23EC4672ADD57D0ADE1061BC24D
                              Malicious:false
                              Reputation:unknown
                              Preview:........,.......,.......D...............8.......6...............................................................K...........................................................................................................................................................................3...............92..................................................................................................................................j.......................k...................................................................................................................Q...........................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):12288
                              Entropy (8bit):5.814115788739565
                              Encrypted:false
                              SSDEEP:
                              MD5:CFF85C549D536F651D4FB8387F1976F2
                              SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                              SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                              SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:GIF image data, version 89a, 16 x 16
                              Category:dropped
                              Size (bytes):997
                              Entropy (8bit):4.188896534234179
                              Encrypted:false
                              SSDEEP:
                              MD5:1636218C14C357455B5C872982E2A047
                              SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                              SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                              SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                              Malicious:false
                              Reputation:unknown
                              Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):39424
                              Entropy (8bit):4.684597989866362
                              Encrypted:false
                              SSDEEP:
                              MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                              SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                              SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                              SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                              Category:dropped
                              Size (bytes):26494
                              Entropy (8bit):1.9568109962493656
                              Encrypted:false
                              SSDEEP:
                              MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                              SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                              SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                              SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                              Malicious:false
                              Reputation:unknown
                              Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):9728
                              Entropy (8bit):5.158136237602734
                              Encrypted:false
                              SSDEEP:
                              MD5:6C3F8C94D0727894D706940A8A980543
                              SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                              SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                              SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\Desktop\Setup.exe
                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Category:modified
                              Size (bytes):24064
                              Entropy (8bit):5.819708895488079
                              Encrypted:false
                              SSDEEP:
                              MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                              SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                              SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                              SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):922
                              Entropy (8bit):5.683808451377969
                              Encrypted:false
                              SSDEEP:
                              MD5:8B7FA34DF699DD431CE93BB010C161D3
                              SHA1:D1518DA044F0E95E0D0DBB50EA622F4BF1B2BDBC
                              SHA-256:0B591FF2209BEFD4B3A83BB10C8C1A10A42C05A212F0412F30AA452744E9E5A7
                              SHA-512:86128396B9CA0F325BC89C73673D751377B467CF9C3C5BF9F045143A0E7F3109D67FFDFE9328BD4CFD8C7E40A6E857B28265271E08DB146C6BEBEDA23B54C062
                              Malicious:false
                              Reputation:unknown
                              Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABZzVjZibruSrXRXP53UoD/EAAAAAoAAABuAHcAagBzAAAAEGYAAAABAAAgAAAALRax3qGNENRe0XQn0cN7gYB8waegOIwu9HrmR8AXWFEAAAAADoAAAAACAAAgAAAAOBPKm2oVYq+cVg8T+UBd/+jTj/zZ1EMzsN6K1jjls9IwAAAAi5nISq875OFgHihIxZwXiYi7IEePu7BtRQ0Sj4+It/luJH2GbO9Kt5Z7pDC222qKQAAAAHvBQn1gmwjjFTiRKzl4v91zyLVGyAhbO9Fv5Gg1WVdbW8JHGe6Jkb1Ip+vgy0gL6CmhruSsg9RhUHRoNtf+A6Y="},"profile":{"info_cache":{},"profile_counts_reported":"13366733397042138","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1722259796"},"user_experience_metrics":{"low_entropy_source3":2848,"pseudo_low_entropy_source":7762,"stability":{"browser_last_live_timestamp":"13366733396986766","stats_buildtime":"1683435600","stats_version":"122.0.6261.69-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"76"}
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):4194304
                              Entropy (8bit):0.17845744405225603
                              Encrypted:false
                              SSDEEP:
                              MD5:B250D27F60A604033CF5C9F3CDDCB13E
                              SHA1:795CB8F9CEC0338C77B4F71D0A6693E3F50375AB
                              SHA-256:8EE745C01DB2CEDBA545445AA1E8E155D93E05C101DD3A34FFB6F896AF5C8EB3
                              SHA-512:304EAA892B0E3D462A13929C04B5F5D45022266DFB011B41E02859E9190D5B721DDFA8A8704C6CBC9E8E0649CE3E536F29D5E196EC78156D5EE82FE06A97DB6A
                              Malicious:false
                              Reputation:unknown
                              Preview:...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....F.........122.0.6261.69-64-devel.....".en-GB*...Windows NT..10.0.190452l..x86_64..?........".qcjbpa20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J..m#:^...YJ....W....J?P.j....... .8.@...............................$01a480e3-ad64-4850-9588-c270c61b4628...<.. .J?.g.z...6.'D.I.V.bHA.7L..].cj1...<..8...(...SyntheticOptimizationGuideRemoteFetching....Disabled.<..8...$...Segmentation_ChromeLowUserEngagement....Unselected...0..,.......Segmentation_SearchUser.....Unselected...4..0.......Segmentation_ShoppingUser.......Unselected...4..0.......Segmentation_CrossDeviceUser....Unselected...4..0.......Segmentation_ResumeHeavyUser....Unselected...4..0.......Segm
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):1048576
                              Entropy (8bit):0.017575195731284944
                              Encrypted:false
                              SSDEEP:
                              MD5:DA810ABF4E4DCBA8E9650A84F36BA4B8
                              SHA1:BDE7026CD6BC6FB732F41DEDA5DDF5CF0D359500
                              SHA-256:0DDCC4AFA6DCDDC23EEC11CC0A1846D940EE2565D6FCC068BBFC2E415FF0B215
                              SHA-512:D8E0B07E4AC1D7C94A02B541538B7735C97A9825158589C44114676E85EF39B12ACDE6018F674EC8D8D7C6C33E40CB8AEAC394B93D3FBD8D48B989987A09606B
                              Malicious:false
                              Reputation:unknown
                              Preview:...@....................@...................@...............`... ...i.y.........CrashpadMetrics.....i.y..Yd.X.......A.......e............,........5l.*...................5l.*.................UMA.PersistentAllocator.CrashpadMetrics.UsedPct.h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A...................V..>....?....{.................?....{.................UMA.PersistentAllocator.CrashpadMetrics.Errors.. ...i.y.[".........................i.y..Yd.........A..................._..-.....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......A...................V..>..../.y.KO................../.y.KO..................Crashpad.ExceptionEncountered.......i.y..Yd.........A............................K..0.................K..0.................Crashpad.ExceptionCode.Win...... ...i.y........K..0............i.y.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):114
                              Entropy (8bit):4.174611854738466
                              Encrypted:false
                              SSDEEP:
                              MD5:E410DD0582BFE7B3381B14465337495D
                              SHA1:E24B65B30208401B69C584CDAA932EF01D8C1384
                              SHA-256:6414C9947B063062C44452F0B5F2D93C931C97AB7E5C17DF24B79A64BC985223
                              SHA-512:38AD41D27B55F2664A19EE248E63FAACD7B6AA71E08A785E37C39016C116057BEC595A59A41F4325314F1799DB5B1CEAC38A318FFC5A0020DB3ACE0277EEBE25
                              Malicious:false
                              Reputation:unknown
                              Preview:DAPC............e.H.A@v@.m.-.U\.....)...V..f....w..f....................1548a965-4041-4076-b66d-db2d85555cdd.dmp..
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:Mini DuMP crash report, 13 streams, Mon Jul 29 13:29:57 2024, 0x200000 type
                              Category:dropped
                              Size (bytes):2243424
                              Entropy (8bit):3.882503165243221
                              Encrypted:false
                              SSDEEP:
                              MD5:B26C492F2F9DE5A067AC68497F846EBF
                              SHA1:BC6DD51C52217D0E3617534CFD15AE63DCFB6AC2
                              SHA-256:A73E1B8C362202A7094BFFDF2D301F51081C0DD82C414C05FF72F1A2D83874F9
                              SHA-512:CDE456CD581DEC30C50F2CD17E768DF2EA5238E5769ACDC32A303C6071AC7DA40449B3C78B1EA29CE452488B511CC68DDCE7DE6FD9E4F28C667ABAD99E298226
                              Malicious:false
                              Reputation:unknown
                              Preview:MDMP........ .......U..f.. .........8...........T...............X...........p...........`.......t#...............C....PC@....F...... ....K......0L...)....kKF....v......dt...x....kK*...t...................eJ..............L.B.........................2.0.0.6.....T...G...x...S..f............................................,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................W.i.n.d.o.w.s. .N.T. .1.0...0...1.9.0.4.5...2.0.0.6.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):40
                              Entropy (8bit):3.939353872167199
                              Encrypted:false
                              SSDEEP:
                              MD5:826C5A94F1F3F283CCEECED94402DC78
                              SHA1:8E70BF819888B31C8CC7C566F5E469D740B5A038
                              SHA-256:BD0A7A4B34BB3CE1098367F094ECC64B8A74C0A22796E2EDCE826EA1CCA5A61B
                              SHA-512:042E7120CD3CBBB22305A6C8FE7DC692AA5ADEE4397AE5AF49E23998E3BFA1336757C3D6E1B2D0D8E3E29121D8D5E872F68655DD334FB1C26B3233507F2269C4
                              Malicious:false
                              Reputation:unknown
                              Preview:sdPC............w..f....|.D..O5I....^..W
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                              Category:dropped
                              Size (bytes):151668
                              Entropy (8bit):1.0550957398929903
                              Encrypted:false
                              SSDEEP:
                              MD5:728FE78292F104659FEA5FC90570CC75
                              SHA1:11B623F76F31EC773B79CDB74869ACB08C4052CB
                              SHA-256:D98E226BEA7A9C56BFDFAB3C484A8E6A0FB173519C43216D3A1115415B166D20
                              SHA-512:91E81B91B29D613FDDE24B010B1724BE74F3BAE1D2FB4FAA2C015178248ED6A0405E2B222F4A557A6B895663C159F0BF0DC6D64D21259299E36F53D95D7067AA
                              Malicious:false
                              Reputation:unknown
                              Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .V....M..(............. .........................................................................................................................................................................................................................................................................................................................(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 5, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 5
                              Category:dropped
                              Size (bytes):53248
                              Entropy (8bit):0.39883547114174095
                              Encrypted:false
                              SSDEEP:
                              MD5:ABD5F8EA3D9A79D25AD874145769B9FD
                              SHA1:0E5CB55791194D802B3D3983BE3A34D364D7A78D
                              SHA-256:50E624AB71E65F7BFF466E9066621F0EE85E87F74EACD85F1952433294E1C5FD
                              SHA-512:19126380F34E2A2517FDA41CB1B824B4A0FB467B60126120DEAB669288FC3E851DA481655DC1887F17762B6394957C4BEE882DC233F7564433E25D947C80E66B
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................r..........g.....e...$.y.........H....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):48
                              Entropy (8bit):2.939830830432992
                              Encrypted:false
                              SSDEEP:
                              MD5:4C4D9EFA56DC01FE9A160A0A1158459E
                              SHA1:4345A98931CB12051F05C9AEE49DCB578E13327F
                              SHA-256:689404667D29BC9520492318A07D98B0FF747B651D52D69AA5F91021FD556C00
                              SHA-512:63D932E7C6395445121936CFC68C0C3B1D48AD8BB53426C0181F4A9D59523A578654ABDC942C151E93A976185A7EFEBB01BCCBBF1D8D8C8C2B0BEB85FEDC4E16
                              Malicious:false
                              Reputation:unknown
                              Preview:(...P...oy retne........................He.#.|/.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                              Category:dropped
                              Size (bytes):262512
                              Entropy (8bit):9.553120663130604E-4
                              Encrypted:false
                              SSDEEP:
                              MD5:053CA58FFB96397D15440029BBCDAA03
                              SHA1:1C65D098B0F55EF3334686B19B53733660F82D0E
                              SHA-256:33D13E8D0071CD3843AD7E59DE1DA21403EE7C42E2B5E816E048608B7CEA8B54
                              SHA-512:FC1C16C7954E745AC8C3794206DC1B1B433F71B8EA5032A0184F877EE3B63209DBA69D003D80CF4A1588209F852B3ADDC403AEF8EB479FD7E5F6AB0BE3007978
                              Malicious:false
                              Reputation:unknown
                              Preview:..........................................,$.|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):76
                              Entropy (8bit):1.8784775129881184
                              Encrypted:false
                              SSDEEP:
                              MD5:CC4A8CFF19ABF3DD35D63CFF1503AA5F
                              SHA1:52AF41B0D9C78AFCC8E308DB846C2B52A636BE38
                              SHA-256:CC5DACF370F324B77B50DDDF5D995FD3C7B7A587CB2F55AC9F24C929D0CD531A
                              SHA-512:0E9559CDA992AA2174A7465745884F73B96755008384D21A0685941ACF099C89C8203B13551DE72A87B8E23CDAAE3FA513BC700B38E1BF3B9026955D97920320
                              Malicious:false
                              Reputation:unknown
                              Preview:.f.5................f.5................f.5................f.5...............
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):275
                              Entropy (8bit):5.1739764695167185
                              Encrypted:false
                              SSDEEP:
                              MD5:7FDBDBDF21DA3D6C39E3B76AAC21CAD3
                              SHA1:982A6438584B73992A97B6E4D0F5814598005100
                              SHA-256:A12978A8AF3D7B2651620BF2AC0848AC6BC6A6695EAD799F0A236A0F1F2F5207
                              SHA-512:45ECE71BAC9895B04DFE531D782256FA5A58350F9C38E6EF0DFA32DD52038DC0BA31F395E5FB96C12466CB3413C756ABEB981A5555F2A8602BE8EBC0925F4DF0
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:29:57.235 1628 Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension Rules since it was missing..2024/07/29-09:30:00.862 1628 Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension Rules/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):38
                              Entropy (8bit):1.8784775129881184
                              Encrypted:false
                              SSDEEP:
                              MD5:51A2CBB807F5085530DEC18E45CB8569
                              SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                              SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                              SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                              Malicious:false
                              Reputation:unknown
                              Preview:.f.5................f.5...............
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):279
                              Entropy (8bit):5.1357612764859395
                              Encrypted:false
                              SSDEEP:
                              MD5:C33366C5FEABA692639C942DD07CC49F
                              SHA1:E3EC62D3C5A439BE73CB84527B8F76190464919D
                              SHA-256:44B536757FABE921FEA4E215CEDA7AE41FC90A8EB5EBD9D693575CD723F7F2F9
                              SHA-512:EF393E51746703C99AA34F3346193DD055300714DACD3389901198EC337BDF710DCAAEA3D2F5795AE30407C2116EE0AD14DF2671570FE1FDE230AE2758A95E5E
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:30:00.865 1628 Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension Scripts since it was missing..2024/07/29-09:30:00.882 1628 Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension Scripts/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):114
                              Entropy (8bit):1.8784775129881184
                              Encrypted:false
                              SSDEEP:
                              MD5:891A884B9FA2BFF4519F5F56D2A25D62
                              SHA1:B54A3C12EE78510CB269FB1D863047DD8F571DEA
                              SHA-256:E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
                              SHA-512:CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
                              Malicious:false
                              Reputation:unknown
                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5...............
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):275
                              Entropy (8bit):5.061160789629989
                              Encrypted:false
                              SSDEEP:
                              MD5:19783FC637C46EFB5DB946F842F90B6F
                              SHA1:0BABC766CB050492AC3C57F7BD681942C4A9F1B7
                              SHA-256:F187EC476AEEB0D89737D41A63E789366719041B6047824ED5032F02C3B9DD48
                              SHA-512:8F7FBA9EE49C339F564147045FEE9AA2252A754F59BE2CDD4A349FF3D1EEE68ED2A728581FBFA3DC131C8178DC7713045125051DFE4013884FD5231B3A8C4F46
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:30:00.901 1dec Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension State since it was missing..2024/07/29-09:30:00.920 1dec Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Extension State/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                              Category:dropped
                              Size (bytes):20480
                              Entropy (8bit):0.697244829403964
                              Encrypted:false
                              SSDEEP:
                              MD5:B40E1BE3D7543B6678720C3AEAF3DEC3
                              SHA1:7758593D371B07423BA7CB84F99EBE3416624F56
                              SHA-256:2DB221A44885C046A4B116717721B688F9A026C4CAE3A17CF61BA9BEF3AD97F4
                              SHA-512:FB0664C1C83043F7C41FD0F1CC0714D81ECD71A07041233FB16FEFEB25A3E182A77AC8AF9910EFF81716B1CCEEE8A7EE84158A564143B0E0D99E00923106CC16
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................r..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):270336
                              Entropy (8bit):8.280239615765425E-4
                              Encrypted:false
                              SSDEEP:
                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                              Malicious:false
                              Reputation:unknown
                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):8192
                              Entropy (8bit):0.011852361981932763
                              Encrypted:false
                              SSDEEP:
                              MD5:0962291D6D367570BEE5454721C17E11
                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                              Malicious:false
                              Reputation:unknown
                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):8192
                              Entropy (8bit):0.012340643231932763
                              Encrypted:false
                              SSDEEP:
                              MD5:41876349CB12D6DB992F1309F22DF3F0
                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                              Malicious:false
                              Reputation:unknown
                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                              Category:dropped
                              Size (bytes):262512
                              Entropy (8bit):9.553120663130604E-4
                              Encrypted:false
                              SSDEEP:
                              MD5:1270703EC1C023780F12E6AB8E91E814
                              SHA1:5D04F80881BD95F1587E5089EBFF816651770152
                              SHA-256:DD10E3C4D734B2E241993B294C0DFC9E7FB045A42B297676AD9FE0EB47C52E12
                              SHA-512:CA391E97FE720676954220E4392558F7A47B73E9BE4A8BCF33EA655D712C7FBF736127CC73B33B0CCAC015F381282D64C350B894B23BAA3B52F23F2BB9D68F35
                              Malicious:false
                              Reputation:unknown
                              Preview:........................................J.*$.|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 1
                              Category:dropped
                              Size (bytes):163840
                              Entropy (8bit):0.5406678582572276
                              Encrypted:false
                              SSDEEP:
                              MD5:F310CF1FF562AE14449E0167A3E1FE46
                              SHA1:85C58AFA9049467031C6C2B17F5C12CA73BB2788
                              SHA-256:E187946249CD390A3C1CF5D4E3B0D8F554F9ACDC416BF4E7111FFF217BB08855
                              SHA-512:1196371DE08C964268C44103CCAED530BDA6A145DF98E0F480D8EE5AD58CB6FB33CA4C9195A52181FE864726DCF52E6A7A466D693AF0CDA43400A3A7EF125FAD
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ .......(...........!......................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                              Category:dropped
                              Size (bytes):40960
                              Entropy (8bit):0.8620857862202844
                              Encrypted:false
                              SSDEEP:
                              MD5:A182561A527F929489BF4B8F74F65CD7
                              SHA1:8CD6866594759711EA1836E86A5B7CA64EE8911F
                              SHA-256:42AAD7886965428A941508B776A666A4450EB658CB90E80FAE1E7457FC71F914
                              SHA-512:9BC3BF5A82F6F057E873ADEBD5B7A4C64ADEF966537AB9C565FE7C4BB3582E2E485FF993D5AB8A6002363231958FABD0933B48811371B8C155EAA74592B66558
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):162
                              Entropy (8bit):4.273886413532386
                              Encrypted:false
                              SSDEEP:
                              MD5:44028E0E05F8498268AA16B5D1BF19FF
                              SHA1:1C241C407F2903727920B5069C4582F5D33369C8
                              SHA-256:2952D4AD35DC8E19F3D10CEFA90B832EB3923B88C472A22F6FD57D4A5CF84E74
                              SHA-512:A8F677CFB8EB25A8A8287AB2ADCF72932FF9AEBFC54EACF55034342BFFA10A212C487B11895C005605737569C24800F5EA82AA9A3FDAED10FD084E897A8FF2C4
                              Malicious:false
                              Reputation:unknown
                              Preview:nwjs settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through nwjs defined APIs.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):40
                              Entropy (8bit):3.473726825238924
                              Encrypted:false
                              SSDEEP:
                              MD5:148079685E25097536785F4536AF014B
                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                              Malicious:false
                              Reputation:unknown
                              Preview:.On.!................database_metadata.1
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):303
                              Entropy (8bit):5.005706657447483
                              Encrypted:false
                              SSDEEP:
                              MD5:EA09CF92DCB3FF74473DFFDE6C87A329
                              SHA1:6B880F9300FF0E04A215A40235DFF815100DFD5B
                              SHA-256:45486997A7A72B45F7F85DB7759FEA7C14B0021EE322FB2F817935EE46DBDDAC
                              SHA-512:F10002F2325E12454DAEE89CEBE647ABBB78F0FF2753E7E9FF0C07CC20DA0AF6429B362D1E243853C11F43FB6A3D20E08C8462F5C8F41A641857D0CE580CDACE
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:29:57.227 1ec0 Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Site Characteristics Database since it was missing..2024/07/29-09:30:00.842 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Site Characteristics Database/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):46
                              Entropy (8bit):4.019797536844534
                              Encrypted:false
                              SSDEEP:
                              MD5:90881C9C26F29FCA29815A08BA858544
                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                              Malicious:false
                              Reputation:unknown
                              Preview:...n'................_mts_schema_descriptor...
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):279
                              Entropy (8bit):5.143698495578732
                              Encrypted:false
                              SSDEEP:
                              MD5:0E7BF17D45CAB842A37CDED9F46C5D3E
                              SHA1:4C8F903D0912B0D0651D3414C6ABDFEDB3C9B7DE
                              SHA-256:F7A56E79DD6EFCC79DC5F3E07253B161595DD810184C309A5D1289049E09CEFC
                              SHA-512:9A7224FBC61BFD19967E95F419854662FF4EB0200A56B0A8C87E4EB0ED5B15ADB93C50C2B60DA982B7BBE498884F90CDCA794369DF0946EDECA2A994CF394EA2
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:29:57.207 1dec Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Sync Data\LevelDB since it was missing..2024/07/29-09:30:00.849 1dec Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                              Category:dropped
                              Size (bytes):20480
                              Entropy (8bit):0.37534326695690934
                              Encrypted:false
                              SSDEEP:
                              MD5:13E588375A53D8AEA197D8C876DDD41D
                              SHA1:B5768D02CAD4E3250833285560244C46B715967E
                              SHA-256:DD7DB9C39D8A5D19AFFCA48792C633C9AC1903C97BDF2CE18E90C1AD97BE7035
                              SHA-512:B174DFB18B0F5692375F55116C36B1A1A1B4B0088732D5D4A81185A9D16CC8AAEDB9EC3E36EE44EC0FDB2C71AEB769C52962A3262C496BC6C25DB0C9DDB2E2F6
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................r..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):131072
                              Entropy (8bit):0.002110589502647469
                              Encrypted:false
                              SSDEEP:
                              MD5:2199EDB99C272AB16B3AFF8CBB6D59AA
                              SHA1:4F3300FD2A8CDC4D151D0F783BAA5C60FE1E3448
                              SHA-256:295BE9EEED62A0739EBDF44CA570ACBBCF023396107D6A1AD6D232469A408D4E
                              SHA-512:AEE0D646687A19F81E4F3CD2B9F90C3C6A42FDB84725AD4DB9AD29D36A850A2E9E504E26602795C6185D694D7902EE9EEEA799077CBE47E8B37F6063D7B1C627
                              Malicious:false
                              Reputation:unknown
                              Preview:VLnk.....?...........{.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 2, database pages 62, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                              Category:dropped
                              Size (bytes):126976
                              Entropy (8bit):0.8773748502171641
                              Encrypted:false
                              SSDEEP:
                              MD5:7C0E2D34B8C9FBDDF80F738F45303571
                              SHA1:87A72E0BB43F5ECCD5BC2A0A2CF8D1217CB71427
                              SHA-256:52E0058EDA175A3290093CA62E3EA61442F2BDC4CB745DE8811F53BF3C5ADE9B
                              SHA-512:AA4A46040FCFD28589F2CAB7F32705315E7029FCEC80F18F44A23D72A14262DDA3C72B452EBAFF39CA6B8E6C9582900C752E1C1CE7B693B02D1B312737D84BB1
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ .......>...........&......................................................r............;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):67
                              Entropy (8bit):4.013120906552776
                              Encrypted:false
                              SSDEEP:
                              MD5:83A0CC26599BC733A4ECF47AA666C6E8
                              SHA1:3AA8C7B2D696C87675AE2C017878200A4589C197
                              SHA-256:B1AAFC2D30EBBDEB10134D965E5E4F1201D7EA2D5812195FA9D4B09E6BB9F766
                              SHA-512:2034B6ECEAC47D63871F2FDD01B1B594B679A1CFD68C6F1AD518EC6EDE5937648EC05C6D91988315E4DC0C06A4B2C40890CACB3F234EEEFD32914B52B8408711
                              Malicious:false
                              Reputation:unknown
                              Preview:...)................41_https://www.example.com/..F................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):275
                              Entropy (8bit):5.121988572918763
                              Encrypted:false
                              SSDEEP:
                              MD5:29E53232302A379769720EF200C651BC
                              SHA1:4568F91890EA815E16A1E0F08B93B783DD55225D
                              SHA-256:D08C6461A4A60EFE4268D9C826DB62CB20EA5FA9A05FEB48BC3E76E2E1E208A9
                              SHA-512:DC1086047459045587A7EC648DF8256A32A4096D8E07DD9CFA8F84F1EFF82938FB35A672335BF84275C57900242AB0CD36F5EC95BE006BD02796A7823F972F51
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:30:00.892 1eb0 Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\shared_proto_db since it was missing..2024/07/29-09:30:00.907 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\shared_proto_db/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:data
                              Category:dropped
                              Size (bytes):474
                              Entropy (8bit):3.8724420626103453
                              Encrypted:false
                              SSDEEP:
                              MD5:42D5E06736D94085F88D3FA785870D1B
                              SHA1:6B058260411F1D270447DE991A3080F98120C45A
                              SHA-256:B113F0CC10DC813E924A2F91A0B1FD3B7AD2CD687A930D74445B57B4F4F76BD6
                              SHA-512:7E47D0075E1202941B4D0DE723274928793DAC829CC7B36BE46CB3BE262485D6DF1E6C58CE26361565413A67226A798B3342CB4C9746971FE352A97BC03C9EC7
                              Malicious:false
                              Reputation:unknown
                              Preview:.h.6.................__global... .t...................__global... ...w.................44_.....g....................49_.....zw.).................48_.....[....................41_.....:.'..................21_.......7..................33_......d...................32_......4...................44_........m.................49_.......p..................48_.......3..................41_.....IG.'.................21_.........................33_......@..................32_.....
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):293
                              Entropy (8bit):5.126334843148502
                              Encrypted:false
                              SSDEEP:
                              MD5:C069F2C9766B1ABC99CA5C6C6882F37D
                              SHA1:8F5623E1F6EB4E70941AB46AF5D8D7EF8D4C8B4F
                              SHA-256:A5394C584BEC78B8F5F2128A902E07460B0129B356777A96FA0FB3E75FB42F20
                              SHA-512:BFACBCB905ACA1EE31838414DF8F985064D312DC2C156ED13057251FEB9145C916D79B696D17480237A4108F7DCA86EFF218AAA64AFB9274726E5942D6E19B2E
                              Malicious:false
                              Reputation:unknown
                              Preview:2024/07/29-09:30:00.859 1eb0 Creating DB C:\Users\user\AppData\Local\pc_app_store\User Data\Default\shared_proto_db\metadata since it was missing..2024/07/29-09:30:00.876 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\pc_app_store\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):13
                              Entropy (8bit):2.449311833026446
                              Encrypted:false
                              SSDEEP:
                              MD5:C47A31A2D1E34FDAAE277778AF22D0E3
                              SHA1:89F03CC294CEA7FC0F34DBEEC269A19BEEA63D11
                              SHA-256:8A99621DC938B98F703F2EB11DF24982287DB9C2BAD487CAFDE8AC18FA876CD6
                              SHA-512:E78045BF4071EF3BEE1E2E1B1F9428E14D0FCC56E04E66492C2E523974DDAC4A883C8A5016D571CBFCB9B5B69003B5671C248A3EFA4DF1D12CB9AEAA9BE9DFA0
                              Malicious:false
                              Reputation:unknown
                              Preview:122.0.6261.69
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                              Category:dropped
                              Size (bytes):8192
                              Entropy (8bit):0.01057775872642915
                              Encrypted:false
                              SSDEEP:
                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                              Malicious:false
                              Reputation:unknown
                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                              Category:dropped
                              Size (bytes):262512
                              Entropy (8bit):9.553120663130604E-4
                              Encrypted:false
                              SSDEEP:
                              MD5:3989EADE30B0EBBB3BD1C36568AB6362
                              SHA1:B2E83B8F7AE09B12BABCBCC855D7EFB1FB276973
                              SHA-256:F42F10D8B4BB67E95D1A9706402F5B6B145411B15770069FF27C809C45491076
                              SHA-512:03B015312477BEC69753141C660FA8709327DF4029C34F31A27F34B4C2FDD7FEBE0021BF09690A6C1AFFD3C212E5C4467E56F08640F6A43DBFB7E631555D5DE1
                              Malicious:false
                              Reputation:unknown
                              Preview:...........................................#.|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\PCAppStore\nwjs\NW_store.exe
                              File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 6, database pages 7, cookie 0x6, schema 4, UTF-8, version-valid-for 6
                              Category:dropped
                              Size (bytes):28672
                              Entropy (8bit):0.3626505885011103
                              Encrypted:false
                              SSDEEP:
                              MD5:3979944F99B92E44FA4B7DBCB6EE91C2
                              SHA1:DF2161C70A820FE43801320F1C25182F891261A4
                              SHA-256:001D755B2B560945440023BF4EBFBDA797CF5106419AC7DD270924B322F3ECF3
                              SHA-512:358E6DEE698A63C2490C2FB5206516766FD8ACE8F3D523509C29FF76AA6A984CB6381468F15BB4B9C084D9A470298B4CC11B0970E671CE0316243069AC4C8590
                              Malicious:false
                              Reputation:unknown
                              Preview:SQLite format 3......@ ..........................................................................r..................x..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 12:28:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2673
                              Entropy (8bit):3.986239607617083
                              Encrypted:false
                              SSDEEP:
                              MD5:082FD9B504676545B5A7ADB262418943
                              SHA1:5E1788A568E2A5728428C29E92492D9E255AF641
                              SHA-256:6714565A7F4347CDBB45DF044B5CB9F530468C283C814AA1161DABDD8BCD09BE
                              SHA-512:9E30D39837778E744378A1889F8941425B3EF87519582E66005CC31965F88C36B631A763DE9EF105408118B52041B1E110398AEAA654577E3F9A8848338868EE
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,......5(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 12:28:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2675
                              Entropy (8bit):4.002408707396575
                              Encrypted:false
                              SSDEEP:
                              MD5:97BA9009DC36E8BBAA8634C15D39868D
                              SHA1:31C097DB3CC4308154C4BFACDE940ACFF96F7730
                              SHA-256:1D85FFEE5F91D56CCA4FD11F5DE0716356E0E7AE0A24C472D76A4F69E9D0179E
                              SHA-512:9A04F0739F6671BE47B198015E1D2A36FFF84B68B1CF961EB0F6213DBCCF996626B9D7DCAFBE8E7EDC91301700F4092C1E0D0AC8203A29A319E6F9297A5775DE
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....8)(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2689
                              Entropy (8bit):4.008624603709377
                              Encrypted:false
                              SSDEEP:
                              MD5:8701543ECFABFC43FC0DE109E064258C
                              SHA1:5005D2742CE3B89E40971B628B751FADCF0FFB3B
                              SHA-256:B8DC152FAEAADEFAEBA9AAD7FF09F10669125224A7B7FBCF2BA928229FAB5D8B
                              SHA-512:D17B289FDB78157EBF476B950E5864EB0DE3153DE8937784FB9DD02CDF3A4127948923F0357C2D20A2146A4AF16185F149C9F4A489F6BD182675C3AEA871D526
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 12:28:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.9987399712767204
                              Encrypted:false
                              SSDEEP:
                              MD5:44983B180B2F432CE4339295BE816527
                              SHA1:CC26AD7FA6DB6E1A01B087874896085496585C3A
                              SHA-256:AB1B627187609BD8D378FF03D0321EC1CF4E68E0A157D02FC1695DFD82CE08D7
                              SHA-512:1EA1AF5A3E083F354B1C46C06CC158C12FE50738DD713467721350F342853D509377347C6670DCFF4F7251F0675A2584B881B849DBA4F9779CE10CD632B9DE6E
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....."(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 12:28:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.987803093810768
                              Encrypted:false
                              SSDEEP:
                              MD5:AD051BF53B79B450623C539D859F8ACC
                              SHA1:0692E9A7D3FF9339A810C57CFD60E2FF16A6409B
                              SHA-256:1059EDD303CC9BA0B131AC62536BCA02EA8F2446FA1B03996456619E349E9B31
                              SHA-512:42728E829CC64EE07F5E3F1ED403D6D9E95BB69C2B661EFCFCC66EE2DB6BEBA4D4B32B14DF7B217F4B0871F04BDE699FD1DD1AB88D681E8D8F53D73A6D2472E5
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....0./(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 29 12:28:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2679
                              Entropy (8bit):3.9987402288526215
                              Encrypted:false
                              SSDEEP:
                              MD5:4ECCC41EE35FCC31CF1C945A5056F13E
                              SHA1:CD7C81EFF40E8A7AF4FBCB5A1BB347D5FB08B208
                              SHA-256:6729B5F8E53EDC460B55E756F3641B7A35E9DC0D5CD49D4CFE1C9CA2CDE535E6
                              SHA-512:FB76C2C1437D78DAF685D6281C5D41316DA54200B16A8DBB1638E1CF6140773DF7B4901D997E8B31825A9899B20E78DC391146B96699C79AE4C9F6121863F680
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....F..(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xok....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............c......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Jun 21 12:27:50 2024, mtime=Mon Jul 29 12:29:46 2024, atime=Fri Jun 21 12:27:50 2024, length=2141536, window=hide
                              Category:dropped
                              Size (bytes):1852
                              Entropy (8bit):3.4738499599959147
                              Encrypted:false
                              SSDEEP:
                              MD5:AC7974363B0C340AB09C693A771603F0
                              SHA1:21007F82655CAFB6E907468D9C7D3E1DEED96FE1
                              SHA-256:F5E9ACE771D77FD0F74F512835DA3596E71B91FA5B35315E6E1A2E550FAAE65B
                              SHA-512:49889898ACF6CBA0E339823703DDDFF999AD31A83EA6C7186147C42E68B48C5A187D47A9C74AFA2CD6B2E824BB423688D467825C30A5A5BF84F39E38C5E03DD6
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. .............3a............`. .....................0.:..DG..Yr?.D..U..k0.&...&.........{4...C'.R......Fa........t...CFSF..1......X.k..PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F.......X.k.X.k............................N.P.C.A.p.p.S.t.o.r.e...D.j.2.`. ..Xyk .PCAPPS~1.EXE..N.......Xyk.X.k....g.........................P.c.A.p.p.S.t.o.r.e...e.x.e.......V...............-.......U.............c......C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.c.a.l.i.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.'.C.:.\.U.s.e.r.s.\.c.a.l.i.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.............................................................................................................................................................................................................................%.U.S.
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):437592
                              Entropy (8bit):6.493521915432252
                              Encrypted:false
                              SSDEEP:
                              MD5:E584051FD8FC3EA480EFAE9A6A246A54
                              SHA1:1EAFDB5095CEE780C47FC710C40EADCC16FE150B
                              SHA-256:B679FBB3CAD4A5738DA27761DA438B2D1A7DD179E40B5A8C15FE87C2EEFB3553
                              SHA-512:B62D821B56F3430A09BD97BE565EC089BBF2A6D622F35BC2706F4A721C35EA4B35CBBFCB8C06DF04D7BDCC997E1C84A8A32920D9CC99C8545E73A314BD54C024
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 19%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+t..o...o...o...$m..c...$m......$m..y...zj..~...zj..y...zj..8...$m..|...o.......W...m...W...n...o.h.n...W...n...Richo...................PE..L.....uf...............%............v.............@.................................C.....@.................................l........0...G..............X).......2..x...T...............................@............................................text...;........................... ..`.rdata..............................@..@.data....+..........................@....rsrc....G...0...H..................@..@.reloc...2.......4...P..............@..B................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                              Category:dropped
                              Size (bytes):2141536
                              Entropy (8bit):6.390678710721619
                              Encrypted:false
                              SSDEEP:
                              MD5:92CC70D7D67DB4A1DFC22857920C9364
                              SHA1:EA5EE53DA20A09CACDC054B2FD462F10C901CB2D
                              SHA-256:71226B69696E60A14E516C80E0852E636E9C2AC1F4498EEB8D38D4A93DC57391
                              SHA-512:390F252A618539E0412177F9B43BA7E46E68909620E9ABE3CBB57DB2EF5E8A207B28C79E6D98BDE7F6DDB520C8D57B62F5D34B7A06AF3D6E1AE75D30BA7C29E7
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 25%
                              Reputation:unknown
                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]*...K...K...K..R3...K..R3...K...4...K...3n..K...4...K...4...K..R3...K..R3...K..R3..>K...K..J..!....K..!....K..!....K...Kj..K..!....K..Rich.K..........................PE..L.....uf...............%.....:......z.............@..........................`!.....dA!...@..........................................0 .P^............ .`).... .........p...........................8...@............................................text............................... ..`.rdata..............................@..@.data....".......z..................@....rsrc...P^...0 ..`...b..............@..@.reloc........ .....................@..B................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):146
                              Entropy (8bit):4.577360416859904
                              Encrypted:false
                              SSDEEP:
                              MD5:2845450EA9D938CFEA9809CA0C827F12
                              SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                              SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                              SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                              Malicious:false
                              Reputation:unknown
                              Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):1718
                              Entropy (8bit):5.214901909338756
                              Encrypted:false
                              SSDEEP:
                              MD5:5095FA52D6B95B632AB44EF09DD04599
                              SHA1:B898790B1E40152106FC0D3822EC88F2A26BD9D3
                              SHA-256:2A7D98B0935EB6246BE244411DAD4E8E6EBB8FDACE7E9C280F9FB88E62756722
                              SHA-512:F4CE97CC6DD928E0D1010B08FE82BD9F970914CB684243C9419EF060337D912FC5B597992CCFE7540FBC77B3E022FF051A4A9979363177E892D97F0BB74AD505
                              Malicious:false
                              Reputation:unknown
                              Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"98","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"4","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"21VXUG","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"LY6L_8RG+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20230522000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Microsoft+Update+Health+Tools","6":"Office+16+Click-to-Run+Licensing+Component","7":"Office+16+Click-to-Run+Extensibility+Comp
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):73
                              Entropy (8bit):4.089026662492467
                              Encrypted:false
                              SSDEEP:
                              MD5:3024A54E0C352ABE5EB5F753CA4828DA
                              SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                              SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                              SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                              Malicious:false
                              Reputation:unknown
                              Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                              Category:dropped
                              Size (bytes):93816
                              Entropy (8bit):6.889543501272891
                              Encrypted:false
                              SSDEEP:
                              MD5:1D87B00FAC4FEF95D766E5B9531A7DF3
                              SHA1:E0FA96AA09C7B261C5CA8AA53F5B07628497E498
                              SHA-256:F58DE1CB3443F1D9668607A9A68E31734A9AB426764B65F3BF25CA5EF67495C8
                              SHA-512:0F17F7DA88ABD491377A44BA3E31BBB02EA8E83D2745DF6233FBAE9BC1EA1046D6570CD98F579702AD7E33C4E6502AAD1A757F724B9C53A94B2962A9FD9E4779
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 29%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......x.....@.............................................HO...........E..`)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):276320
                              Entropy (8bit):6.1430306959406735
                              Encrypted:false
                              SSDEEP:
                              MD5:7B432B3DA82D7E40916D1D2EB6F9F48D
                              SHA1:E399E64D069169E9C61068D111B7CF5F57BAE513
                              SHA-256:828AD0151134C8A6E80B3D1716BF8A35CD902B3EECF7E3009987693FFD696AE4
                              SHA-512:EAE6B619014979F7B529BFBC923D1F1047EFDF8C15BBB306FB4E02A9AAE05DBD99036602F7606B53812AF7DA369E55AD84D08B25DA8A083F3BF3121016762716
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 11%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X.L.6.L.6.L.6...5.I.6...3...6...2.F.6.Y.2.\.6.Y.5.E.6.Y.3.s.6...7.A.6.L.7...6.tF3.N.6.tF.M.6.L..M.6.tF4.M.6.RichL.6.................PE..d.....uf.........."....%.............*.........@.............................p............`..................................................w..x........G......\1......`)...`......p?..p....................@..(...0>..@............................................text...@........................... ..`.rdata..............................@..@.data...|&...........z..............@....pdata..\1.......2..................@..@_RDATA..\...........................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):2312704
                              Entropy (8bit):6.449649685576397
                              Encrypted:false
                              SSDEEP:
                              MD5:E472E46BDFD736351D4B086B4C4CA134
                              SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                              SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                              SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:HTML document, ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):9560433
                              Entropy (8bit):4.8475056659478915
                              Encrypted:false
                              SSDEEP:
                              MD5:7A32B7C762C76BD3EE38E3E998705899
                              SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                              SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                              SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                              Malicious:false
                              Reputation:unknown
                              Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):4916712
                              Entropy (8bit):6.398049523846958
                              Encrypted:false
                              SSDEEP:
                              MD5:2191E768CC2E19009DAD20DC999135A3
                              SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                              SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                              SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):2028032
                              Entropy (8bit):6.64708834859118
                              Encrypted:false
                              SSDEEP:
                              MD5:5FFF6F0423A38BFAF174CB670650F4F9
                              SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                              SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                              SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):10717392
                              Entropy (8bit):6.282534560973548
                              Encrypted:false
                              SSDEEP:
                              MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                              SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                              SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                              SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                              Malicious:false
                              Reputation:unknown
                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):454144
                              Entropy (8bit):6.3485070297294985
                              Encrypted:false
                              SSDEEP:
                              MD5:7255FCCD39F330CA2123F380B4967E0A
                              SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                              SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                              SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):8058880
                              Entropy (8bit):6.448026576223661
                              Encrypted:false
                              SSDEEP:
                              MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                              SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                              SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                              SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):502905
                              Entropy (8bit):5.409605383978337
                              Encrypted:false
                              SSDEEP:
                              MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                              SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                              SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                              SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                              Malicious:false
                              Reputation:unknown
                              Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):813426
                              Entropy (8bit):4.915984741122479
                              Encrypted:false
                              SSDEEP:
                              MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                              SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                              SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                              SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                              Malicious:false
                              Reputation:unknown
                              Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):822020
                              Entropy (8bit):4.925237393732045
                              Encrypted:false
                              SSDEEP:
                              MD5:621B390B8AF0C70D682715323A92B61F
                              SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                              SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                              SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):897122
                              Entropy (8bit):4.928723053414015
                              Encrypted:false
                              SSDEEP:
                              MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                              SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                              SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                              SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):927865
                              Entropy (8bit):4.686646990438899
                              Encrypted:false
                              SSDEEP:
                              MD5:27C55B97D549BCF13145EC75F0A503CA
                              SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                              SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                              SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                              Malicious:false
                              Reputation:unknown
                              Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:CSV text
                              Category:dropped
                              Size (bytes):1051021
                              Entropy (8bit):5.4211132061857965
                              Encrypted:false
                              SSDEEP:
                              MD5:82D7AB0FF6C34DB264FD6778818F42B1
                              SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                              SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                              SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                              Malicious:false
                              Reputation:unknown
                              Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1193463
                              Entropy (8bit):4.299730648702171
                              Encrypted:false
                              SSDEEP:
                              MD5:7351AE61AE5884088AE68CE5BE0043D8
                              SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                              SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                              SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                              Malicious:false
                              Reputation:unknown
                              Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):573774
                              Entropy (8bit):5.391859865204477
                              Encrypted:false
                              SSDEEP:
                              MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                              SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                              SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                              SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                              Malicious:false
                              Reputation:unknown
                              Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):583431
                              Entropy (8bit):5.838398613999325
                              Encrypted:false
                              SSDEEP:
                              MD5:7F1AD2897B210C4C25CFBDF0736F6809
                              SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                              SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                              SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):530651
                              Entropy (8bit):5.44607278354406
                              Encrypted:false
                              SSDEEP:
                              MD5:9D6A98D53208092F687AD7BB3DBAED7D
                              SHA1:161D0689CA85147B356167F98EAD84783E331986
                              SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                              SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                              Malicious:false
                              Reputation:unknown
                              Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):571551
                              Entropy (8bit):5.489447532911186
                              Encrypted:false
                              SSDEEP:
                              MD5:851D55585CBC90143DD4C70EB4900574
                              SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                              SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                              SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1016551
                              Entropy (8bit):4.766567786580532
                              Encrypted:false
                              SSDEEP:
                              MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                              SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                              SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                              SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                              Malicious:false
                              Reputation:unknown
                              Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):459985
                              Entropy (8bit):5.5152848417450615
                              Encrypted:false
                              SSDEEP:
                              MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                              SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                              SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                              SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):464664
                              Entropy (8bit):5.505055040425703
                              Encrypted:false
                              SSDEEP:
                              MD5:4B6300C27E7575C32888C1F3364D5346
                              SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                              SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                              SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1031027
                              Entropy (8bit):5.210875521790238
                              Encrypted:false
                              SSDEEP:
                              MD5:D5A14353A7FCC1F199F9234BD4551FF9
                              SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                              SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                              SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):560321
                              Entropy (8bit):5.366866302767652
                              Encrypted:false
                              SSDEEP:
                              MD5:AAB525A7681AE93791B283205064E2B4
                              SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                              SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                              SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                              Malicious:false
                              Reputation:unknown
                              Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):559178
                              Entropy (8bit):5.34611084339133
                              Encrypted:false
                              SSDEEP:
                              MD5:078BD56804D26C26E9AA4F41BF6549F6
                              SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                              SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                              SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                              Malicious:false
                              Reputation:unknown
                              Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):509452
                              Entropy (8bit):5.455817407928288
                              Encrypted:false
                              SSDEEP:
                              MD5:45E28E64378FABED845EB242A8F1563D
                              SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                              SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                              SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                              Malicious:false
                              Reputation:unknown
                              Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):825360
                              Entropy (8bit):5.0557125829631335
                              Encrypted:false
                              SSDEEP:
                              MD5:A13029CB1D5873121E6BDD0929A6C772
                              SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                              SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                              SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):517467
                              Entropy (8bit):5.424845538875905
                              Encrypted:false
                              SSDEEP:
                              MD5:E7B72F44D711DECE8E3043173A553AC4
                              SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                              SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                              SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):584976
                              Entropy (8bit):5.195604084490558
                              Encrypted:false
                              SSDEEP:
                              MD5:F7F3CC17509AF03E639E983A091C2026
                              SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                              SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                              SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):606342
                              Entropy (8bit):5.380118288987104
                              Encrypted:false
                              SSDEEP:
                              MD5:326917C8F37FE85E58AD3DE991D17A78
                              SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                              SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                              SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1177779
                              Entropy (8bit):4.338116428198543
                              Encrypted:false
                              SSDEEP:
                              MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                              SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                              SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                              SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                              Malicious:false
                              Reputation:unknown
                              Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):728589
                              Entropy (8bit):4.658856122190603
                              Encrypted:false
                              SSDEEP:
                              MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                              SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                              SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                              SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):569413
                              Entropy (8bit):6.084713993678112
                              Encrypted:false
                              SSDEEP:
                              MD5:E8448C3D352C76C1C0F2B9F508852D9A
                              SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                              SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                              SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                              Malicious:false
                              Reputation:unknown
                              Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):611429
                              Entropy (8bit):5.6299671018290445
                              Encrypted:false
                              SSDEEP:
                              MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                              SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                              SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                              SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                              Malicious:false
                              Reputation:unknown
                              Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):610750
                              Entropy (8bit):5.626685122127425
                              Encrypted:false
                              SSDEEP:
                              MD5:8D8244CEA7D00E7502CFC62908147BB7
                              SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                              SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                              SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                              Malicious:false
                              Reputation:unknown
                              Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1394062
                              Entropy (8bit):4.285571867304228
                              Encrypted:false
                              SSDEEP:
                              MD5:979090995F7F9DBFA9FA9A96349DA745
                              SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                              SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                              SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                              Malicious:false
                              Reputation:unknown
                              Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1147816
                              Entropy (8bit):4.319695697825778
                              Encrypted:false
                              SSDEEP:
                              MD5:7862ABEC5008FAC0A8924B65B3058C05
                              SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                              SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                              SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):524044
                              Entropy (8bit):5.251286724342732
                              Encrypted:false
                              SSDEEP:
                              MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                              SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                              SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                              SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                              Malicious:false
                              Reputation:unknown
                              Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):508553
                              Entropy (8bit):5.428763068409714
                              Encrypted:false
                              SSDEEP:
                              MD5:40B668B73BBF3575D009F3D528D388E5
                              SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                              SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                              SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                              Malicious:false
                              Reputation:unknown
                              Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):525362
                              Entropy (8bit):5.366124885898627
                              Encrypted:false
                              SSDEEP:
                              MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                              SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                              SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                              SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):587942
                              Entropy (8bit):5.759897632158159
                              Encrypted:false
                              SSDEEP:
                              MD5:2D6468A89698A05B8522F679825572D3
                              SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                              SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                              SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                              Malicious:false
                              Reputation:unknown
                              Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):551569
                              Entropy (8bit):5.417670979179483
                              Encrypted:false
                              SSDEEP:
                              MD5:FBD585195E35E49C60A9190FBF815E86
                              SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                              SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                              SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                              Malicious:false
                              Reputation:unknown
                              Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):555353
                              Entropy (8bit):5.392038775374042
                              Encrypted:false
                              SSDEEP:
                              MD5:C64146716C2A401FEC538E4C79785144
                              SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                              SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                              SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                              Malicious:false
                              Reputation:unknown
                              Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):574388
                              Entropy (8bit):5.451836104471441
                              Encrypted:false
                              SSDEEP:
                              MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                              SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                              SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                              SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):941599
                              Entropy (8bit):4.851052751447414
                              Encrypted:false
                              SSDEEP:
                              MD5:36D9CBBB31930EB5B78378EC63751BE6
                              SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                              SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                              SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):592404
                              Entropy (8bit):5.807054231111397
                              Encrypted:false
                              SSDEEP:
                              MD5:59822645439846B0A211C8566E7CF90E
                              SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                              SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                              SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                              Malicious:false
                              Reputation:unknown
                              Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):568760
                              Entropy (8bit):5.4785168337779435
                              Encrypted:false
                              SSDEEP:
                              MD5:970F310ACBAFA4A29E0CFA5C979DF397
                              SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                              SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                              SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):872667
                              Entropy (8bit):4.788135484665425
                              Encrypted:false
                              SSDEEP:
                              MD5:5E439D9D281D90569CD4AA231FC8B287
                              SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                              SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                              SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                              Malicious:false
                              Reputation:unknown
                              Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):512705
                              Entropy (8bit):5.538975019723545
                              Encrypted:false
                              SSDEEP:
                              MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                              SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                              SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                              SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):539452
                              Entropy (8bit):5.338235032300934
                              Encrypted:false
                              SSDEEP:
                              MD5:F0314E8F5AF94C845AB4218468AF3454
                              SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                              SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                              SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                              Malicious:false
                              Reputation:unknown
                              Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1387366
                              Entropy (8bit):4.061553280377292
                              Encrypted:false
                              SSDEEP:
                              MD5:4411E4698E279FB95ADEA7BE9625F800
                              SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                              SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                              SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                              Malicious:false
                              Reputation:unknown
                              Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1281329
                              Entropy (8bit):4.31693967998977
                              Encrypted:false
                              SSDEEP:
                              MD5:443D47F30632512C7E5A6E142D2A3CA3
                              SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                              SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                              SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                              Malicious:false
                              Reputation:unknown
                              Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1076392
                              Entropy (8bit):4.3678914271676845
                              Encrypted:false
                              SSDEEP:
                              MD5:ABFAD720A09628E229EE75C14DCC1DEE
                              SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                              SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                              SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                              Malicious:false
                              Reputation:unknown
                              Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):550618
                              Entropy (8bit):5.609493488679069
                              Encrypted:false
                              SSDEEP:
                              MD5:CE85F55613C69479E13D011F0B81E3F1
                              SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                              SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                              SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                              Malicious:false
                              Reputation:unknown
                              Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):938457
                              Entropy (8bit):4.888192308730272
                              Encrypted:false
                              SSDEEP:
                              MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                              SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                              SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                              SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):817673
                              Entropy (8bit):5.177156515939135
                              Encrypted:false
                              SSDEEP:
                              MD5:3129155651C81F86E5E2794B0CD15EC7
                              SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                              SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                              SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                              Malicious:false
                              Reputation:unknown
                              Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):651358
                              Entropy (8bit):5.790776889845594
                              Encrypted:false
                              SSDEEP:
                              MD5:5910DEDFBC84629690DD59478E80B51A
                              SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                              SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                              SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):472125
                              Entropy (8bit):6.686635546459109
                              Encrypted:false
                              SSDEEP:
                              MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                              SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                              SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                              SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):469061
                              Entropy (8bit):6.698957808032297
                              Encrypted:false
                              SSDEEP:
                              MD5:687995F645CB9169DBFC3431E8FCFE3B
                              SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                              SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                              SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                              Malicious:false
                              Reputation:unknown
                              Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):18401792
                              Entropy (8bit):6.484724602010289
                              Encrypted:false
                              SSDEEP:
                              MD5:6A067CB26AF2C240C240BC81C4A4F311
                              SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                              SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                              SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):1162240
                              Entropy (8bit):6.551791881008996
                              Encrypted:false
                              SSDEEP:
                              MD5:EDF83410995BEA188731EF377334ED7B
                              SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                              SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                              SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):196713984
                              Entropy (8bit):6.709853681888895
                              Encrypted:false
                              SSDEEP:
                              MD5:0B9A2D445F28B403D525380817A2636E
                              SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                              SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                              SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):685745
                              Entropy (8bit):7.962986984739525
                              Encrypted:false
                              SSDEEP:
                              MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                              SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                              SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                              SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                              Malicious:false
                              Reputation:unknown
                              Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):1079219
                              Entropy (8bit):7.95049008504143
                              Encrypted:false
                              SSDEEP:
                              MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                              SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                              SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                              SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                              Malicious:false
                              Reputation:unknown
                              Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):1134592
                              Entropy (8bit):6.555043286804751
                              Encrypted:false
                              SSDEEP:
                              MD5:364F839CA8DE4D942270D9097D48EF15
                              SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                              SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                              SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):4656369
                              Entropy (8bit):7.995866504972196
                              Encrypted:true
                              SSDEEP:
                              MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                              SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                              SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                              SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                              Malicious:false
                              Reputation:unknown
                              Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):686733
                              Entropy (8bit):5.111423885670035
                              Encrypted:false
                              SSDEEP:
                              MD5:E68978443DDAFD40434C87818C90D338
                              SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                              SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                              SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                              Malicious:false
                              Reputation:unknown
                              Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):4483072
                              Entropy (8bit):6.30617269058202
                              Encrypted:false
                              SSDEEP:
                              MD5:DB64B157590C89B63D7E7FCF97FD7A01
                              SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                              SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                              SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):106
                              Entropy (8bit):4.724752649036734
                              Encrypted:false
                              SSDEEP:
                              MD5:8642DD3A87E2DE6E991FAE08458E302B
                              SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                              SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                              SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                              Malicious:false
                              Reputation:unknown
                              Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                              Category:dropped
                              Size (bytes):918016
                              Entropy (8bit):6.582669085817742
                              Encrypted:false
                              SSDEEP:
                              MD5:C59EE747C59CD7B450DB71FD836E7153
                              SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                              SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                              SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                              Malicious:true
                              Antivirus:
                              • Antivirus: ReversingLabs, Detection: 0%
                              Reputation:unknown
                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                              Category:dropped
                              Size (bytes):16958
                              Entropy (8bit):1.8361199320851
                              Encrypted:false
                              SSDEEP:
                              MD5:815665F58B066A42DE47F55ED686D184
                              SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                              SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                              SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                              Malicious:false
                              Reputation:unknown
                              Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):1303
                              Entropy (8bit):4.902823679084491
                              Encrypted:false
                              SSDEEP:
                              MD5:737299890A8B772E5801BA40F8F3B022
                              SHA1:AC437939DF1661CF07E6AE9C46B3D31F6F497434
                              SHA-256:ED736B2E82A830482890102BFD2DB70C3FD324FFEA4056B8737B12E327899E8A
                              SHA-512:8B66A6B3B8210DDC278C60252BE96B2C0FDECDE5EE7A8AACC811505842ABED52DEFBC8B927ECAE0371EC0D0EA7341E71EB6B9B12B599B20D578C04BED524A200
                              Malicious:false
                              Reputation:unknown
                              Preview:{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.dcaf9235.chunk.js",. "main.js.map": "/static/js/main.dcaf9235.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.0e8f1429.chunk.js": "/static/js/2.0e8f1429.chunk.js",. "static/js/2.0e8f1429.chunk.js.map": "/static/js/2.0e8f1429.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.0e8f1429.chunk.js.LICENSE.txt": "/static/js/2.0e8f1429.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):278
                              Entropy (8bit):6.614793808897997
                              Encrypted:false
                              SSDEEP:
                              MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                              SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                              SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                              SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):506
                              Entropy (8bit):7.41701077919571
                              Encrypted:false
                              SSDEEP:
                              MD5:6B5236D9B2E90E8DE0698738970AD3BC
                              SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                              SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                              SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                              Category:dropped
                              Size (bytes):4286
                              Entropy (8bit):1.9733781811385676
                              Encrypted:false
                              SSDEEP:
                              MD5:B71C63AF25F44A21143174E24791FBFB
                              SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                              SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                              SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                              Malicious:false
                              Reputation:unknown
                              Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                              Category:dropped
                              Size (bytes):3269
                              Entropy (8bit):5.261013244860872
                              Encrypted:false
                              SSDEEP:
                              MD5:B3C4B6DA8FA7E44B8A10FA3316F66356
                              SHA1:9A93BDF1C70DCC9504C00CD0D3F212D622787EC3
                              SHA-256:C6CA5E960B32E913B85AB676BC7C518431755DE33C28FD9716939B333EAF8F58
                              SHA-512:F3F7F6D22B426E9B1AAA31E1F3568F1F74BB627898B297C2BB90821E0CA40909698230F6DF25041E00B5AE1D59CFC34BBDFC3B338BE279A3DAF270FBDE3F3118
                              Malicious:false
                              Reputation:unknown
                              Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):499
                              Entropy (8bit):4.571997514321595
                              Encrypted:false
                              SSDEEP:
                              MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                              SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                              SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                              SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                              Malicious:false
                              Reputation:unknown
                              Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):2511
                              Entropy (8bit):4.786444073109678
                              Encrypted:false
                              SSDEEP:
                              MD5:BA0268049BD46633F0423F58B70A6766
                              SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                              SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                              SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                              Malicious:false
                              Reputation:unknown
                              Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):70
                              Entropy (8bit):4.431168424936135
                              Encrypted:false
                              SSDEEP:
                              MD5:61C27D2CD39A713F7829422C3D9EDCC7
                              SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                              SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                              SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                              Malicious:false
                              Reputation:unknown
                              Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with very long lines (40486)
                              Category:dropped
                              Size (bytes):40538
                              Entropy (8bit):5.038776756689567
                              Encrypted:false
                              SSDEEP:
                              MD5:BA8B67B72756499BC9D31F02415F8F95
                              SHA1:5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
                              SHA-256:EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
                              SHA-512:BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
                              Malicious:false
                              Reputation:unknown
                              Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):75429
                              Entropy (8bit):5.131553566266101
                              Encrypted:false
                              SSDEEP:
                              MD5:DF0CB96BE26094690EC20638CFD19744
                              SHA1:730926C0825BE3FDE3157F5858E7BD2F0C3FB289
                              SHA-256:875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
                              SHA-512:58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
                              Malicious:false
                              Reputation:unknown
                              Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):673416
                              Entropy (8bit):6.007715100140441
                              Encrypted:false
                              SSDEEP:
                              MD5:256C2960C1C6B5125CF8BE9A74EFC861
                              SHA1:476C3A279B9B70AF869C174D177021043E75DC3C
                              SHA-256:F7EE797420975CB738D9AB3989EF454B9DB080BDE6A186E94D813ECFC1710ADD
                              SHA-512:01E429495544B6381BBDF9EB8738FD8BF8D9AEAA5945536108EC61D7666AB6A7238D3E752DA1912FADD799523D7236722E2837D937F802C2EAC66EAE83FC0C59
                              Malicious:false
                              Reputation:unknown
                              Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):66
                              Entropy (8bit):4.90372423276536
                              Encrypted:false
                              SSDEEP:
                              MD5:F067DAFE94D1DB7AF2C5420C12E48660
                              SHA1:0C8B03D660DF4D0E08E38C9D1B51A85BD797D580
                              SHA-256:B2973036345797A370D9C05465DF1A8E42A8DD064C0508CC1761F74B093EA04D
                              SHA-512:5163F1ADFFBF83876C039934627CEB929D7205573EA104678FCAE464ABC76B415D8F122FB56710BB4DF8A2A2BEC58E22593A33EF8D8C95EF149C3721684DA55D
                              Malicious:false
                              Reputation:unknown
                              Preview:nw.Window.get().evalNWBin(null, "static/js/2.0e8f1429.chunk.bin");
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text
                              Category:dropped
                              Size (bytes):1686
                              Entropy (8bit):4.736390551286131
                              Encrypted:false
                              SSDEEP:
                              MD5:10A587045DF3F39CD774951756F33E54
                              SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                              SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                              SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                              Malicious:false
                              Reputation:unknown
                              Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):1024473
                              Entropy (8bit):5.4235483730669785
                              Encrypted:false
                              SSDEEP:
                              MD5:BD3FF30D96539DE94E32DD93D20A61AB
                              SHA1:477D734E087FA63CD86C4A2FAD818B752C96F5F8
                              SHA-256:5932667EE4B9237679ACE27827C089118A7D9B10D1AA064E93AC2F0F2A1C161D
                              SHA-512:D86E06AC5983EE00DC52DD4B52BF088CF1CE583DB15B70798EC49BA39E0969B0CA958959AF1C1A9747ECAC3499D656B9CAC3F894B8ACB5AD6755768BB4A10A6E
                              Malicious:false
                              Reputation:unknown
                              Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):16240
                              Entropy (8bit):5.4978991340628935
                              Encrypted:false
                              SSDEEP:
                              MD5:1B83BDE47892A049925572BD77B5E3B3
                              SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                              SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                              SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                              Malicious:false
                              Reputation:unknown
                              Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):66
                              Entropy (8bit):4.8128151418562695
                              Encrypted:false
                              SSDEEP:
                              MD5:B3E7D84CF0B8A2298C89F91F084C0809
                              SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                              SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                              SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                              Malicious:false
                              Reputation:unknown
                              Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):9898
                              Entropy (8bit):5.1083863257804785
                              Encrypted:false
                              SSDEEP:
                              MD5:B079CA1E88F9F0249B645CF6809C0059
                              SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                              SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                              SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                              Malicious:false
                              Reputation:unknown
                              Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):456496
                              Entropy (8bit):6.15084447512208
                              Encrypted:false
                              SSDEEP:
                              MD5:CE1CC6C8BC3F31797D3EA709A1903258
                              SHA1:6F82BAC73F550DB3AB59F60991B7A9B4028A35FD
                              SHA-256:DD0E08292A1E45C37FDA2788F753A222B8BC1A5121349EE9179EF7650AC3A2E3
                              SHA-512:77F8EAEB94170094A6886D0EF7F4FEF15027EF2950E3B49FFC367F740EC3CECFD244447EFAE9C1D4CD5C16B1DA08EAB10188C7C1D4243C693BE835A2796B2120
                              Malicious:false
                              Reputation:unknown
                              Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`D........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):69
                              Entropy (8bit):4.818153986638205
                              Encrypted:false
                              SSDEEP:
                              MD5:91613390657C6441F0CDDD8667B810E7
                              SHA1:22219D5ABBF00A99E04961707C76ED2B4D757FEC
                              SHA-256:CFB0C2F91BCE0BCCF2F7EF7B8332C058FBFE46D6793EA39BBBDFD1B9BFD7EAB6
                              SHA-512:0B32C0CA790AEB8DD72719A0E36AA7350392980C52452753D72714D234C82D6A99275FCA57B9C344084C711E78AF835C77B5A1018BEE8BF224CCBB2F8809A692
                              Malicious:false
                              Reputation:unknown
                              Preview:nw.Window.get().evalNWBin(null, "static/js/main.dcaf9235.chunk.bin");
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):690187
                              Entropy (8bit):5.3657387593915145
                              Encrypted:false
                              SSDEEP:
                              MD5:005BAEA3D0DE083DBFB5CDD57339DA95
                              SHA1:ED7EA1D41292392F5C6DA850C7F4B10FE1DF2647
                              SHA-256:04383BD4D0558A3FD8DCDC658F56A23D4F41B95BD7D72563246271C3C556A1E7
                              SHA-512:6E9AEC321BAC4848550F00D96FE8B897F67202E076981820492ACE9CE0BD517ACFC5A34EA629F8998C316A637E76BF5E2A024EFD41BE0E933F025ADABC359534
                              Malicious:false
                              Reputation:unknown
                              Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:data
                              Category:dropped
                              Size (bytes):6880
                              Entropy (8bit):5.780693101615468
                              Encrypted:false
                              SSDEEP:
                              MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                              SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                              SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                              SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                              Malicious:false
                              Reputation:unknown
                              Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):71
                              Entropy (8bit):4.7442478245494595
                              Encrypted:false
                              SSDEEP:
                              MD5:07D51995B0C40EB6A7D648682400933E
                              SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                              SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                              SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                              Malicious:false
                              Reputation:unknown
                              Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):12604
                              Entropy (8bit):5.32907166018772
                              Encrypted:false
                              SSDEEP:
                              MD5:C7F90D5C550BFEECD43C415429428E79
                              SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                              SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                              SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                              Malicious:false
                              Reputation:unknown
                              Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):1370
                              Entropy (8bit):5.283353360674453
                              Encrypted:false
                              SSDEEP:
                              MD5:C28FE12628EAF4B73719080A13F8E1A5
                              SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                              SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                              SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                              Malicious:false
                              Reputation:unknown
                              Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):5175
                              Entropy (8bit):3.933853115875902
                              Encrypted:false
                              SSDEEP:
                              MD5:CF8666E7736704C07412232858C9CBA3
                              SHA1:EE8666C41448498D22620353C27EB8489D763249
                              SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                              SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2823
                              Entropy (8bit):4.491649868709728
                              Encrypted:false
                              SSDEEP:
                              MD5:0F2E1681746D0E29CF14FE6D88B557D7
                              SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                              SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                              SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                              Malicious:false
                              Reputation:unknown
                              Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):854
                              Entropy (8bit):4.266600052838456
                              Encrypted:false
                              SSDEEP:
                              MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                              SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                              SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                              SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):852
                              Entropy (8bit):4.275850671375772
                              Encrypted:false
                              SSDEEP:
                              MD5:2CCC89303FC39BE9450730A8B415E094
                              SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                              SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                              SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4743
                              Entropy (8bit):3.9546492458044593
                              Encrypted:false
                              SSDEEP:
                              MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                              SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                              SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                              SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4729
                              Entropy (8bit):3.9826071199242548
                              Encrypted:false
                              SSDEEP:
                              MD5:7B3329DB8105F1C10A0432343AA96772
                              SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                              SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                              SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):1592
                              Entropy (8bit):4.004290849514056
                              Encrypted:false
                              SSDEEP:
                              MD5:D9F81AE3849F84F6F219B2831F088247
                              SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                              SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                              SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):1590
                              Entropy (8bit):4.012220474436418
                              Encrypted:false
                              SSDEEP:
                              MD5:4DB5D94C4F838E720E17332EDF740EBC
                              SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                              SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                              SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4264
                              Entropy (8bit):3.894045254391696
                              Encrypted:false
                              SSDEEP:
                              MD5:E25CBB3FF275E58AF7891E0B857550A1
                              SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                              SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                              SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4238
                              Entropy (8bit):3.914834455290012
                              Encrypted:false
                              SSDEEP:
                              MD5:2A64F22D46EF697D361BC13F4E5EC382
                              SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                              SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                              SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):6098
                              Entropy (8bit):3.8868971852897896
                              Encrypted:false
                              SSDEEP:
                              MD5:8EBCB6408685047BE3BD1996D4000EE4
                              SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                              SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                              SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):6086
                              Entropy (8bit):3.9063223215918432
                              Encrypted:false
                              SSDEEP:
                              MD5:048482A7B181541A174551C016205A44
                              SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                              SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                              SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):6801
                              Entropy (8bit):3.7386877939405805
                              Encrypted:false
                              SSDEEP:
                              MD5:6DD649E7B024D0758023476637791EFF
                              SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                              SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                              SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):6797
                              Entropy (8bit):3.744755737482207
                              Encrypted:false
                              SSDEEP:
                              MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                              SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                              SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                              SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3605
                              Entropy (8bit):3.914389459303166
                              Encrypted:false
                              SSDEEP:
                              MD5:477A237F6AE8615FA3C957919C161FFC
                              SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                              SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                              SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3599
                              Entropy (8bit):3.928807214825618
                              Encrypted:false
                              SSDEEP:
                              MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                              SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                              SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                              SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2232
                              Entropy (8bit):3.9969278840420657
                              Encrypted:false
                              SSDEEP:
                              MD5:73CD1627E147A8EAD813AD7201D75876
                              SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                              SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                              SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2228
                              Entropy (8bit):4.011244246624798
                              Encrypted:false
                              SSDEEP:
                              MD5:D4950E85D1EDD93F20A610F0B9575A1B
                              SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                              SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                              SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):702
                              Entropy (8bit):4.39074490019929
                              Encrypted:false
                              SSDEEP:
                              MD5:86893B121171A45F3494D301D57E80F1
                              SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                              SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                              SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):700
                              Entropy (8bit):4.387297248681374
                              Encrypted:false
                              SSDEEP:
                              MD5:C6D2A075413FDBCB286B77A97F9B6F13
                              SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                              SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                              SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3466
                              Entropy (8bit):3.9394896115708424
                              Encrypted:false
                              SSDEEP:
                              MD5:97A4CAA52C453393A3ACEDB7EB240010
                              SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                              SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                              SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3460
                              Entropy (8bit):3.951932320279216
                              Encrypted:false
                              SSDEEP:
                              MD5:7BBD80A02464154C092ACBE7DD328730
                              SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                              SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                              SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4403
                              Entropy (8bit):3.8960426134967934
                              Encrypted:false
                              SSDEEP:
                              MD5:360145CB691391CCC038500BAD652269
                              SHA1:4F2D87620766892151D6087962DCB08628FC1220
                              SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                              SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):4395
                              Entropy (8bit):3.9130769273478307
                              Encrypted:false
                              SSDEEP:
                              MD5:B0F49189BE082A137803BEA947266CC9
                              SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                              SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                              SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):1858
                              Entropy (8bit):4.054255384536267
                              Encrypted:false
                              SSDEEP:
                              MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                              SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                              SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                              SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):1854
                              Entropy (8bit):4.069519451091226
                              Encrypted:false
                              SSDEEP:
                              MD5:FCA164880EE2E1D12B798C98241DCB76
                              SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                              SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                              SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2922
                              Entropy (8bit):3.8955256034331684
                              Encrypted:false
                              SSDEEP:
                              MD5:60F659C2639149E5FE452A99BA232B94
                              SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                              SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                              SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2920
                              Entropy (8bit):3.895777405127468
                              Encrypted:false
                              SSDEEP:
                              MD5:610CC1A8CF2F609FCD872D217E3D4333
                              SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                              SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                              SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3445
                              Entropy (8bit):3.979453075901205
                              Encrypted:false
                              SSDEEP:
                              MD5:8517A7C9AC10921DEBA471DD89A13601
                              SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                              SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                              SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3425
                              Entropy (8bit):4.01234712901125
                              Encrypted:false
                              SSDEEP:
                              MD5:0C92AF8318B8C3247643257AF05FD42E
                              SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                              SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                              SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.
                              Process:C:\Users\user\AppData\Local\Temp\nsfE22.tmp
                              File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):11957
                              Entropy (8bit):7.943985153985361
                              Encrypted:false
                              SSDEEP:
                              MD5:5D3291D90D252B1C09C262466D67D04A
                              SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                              SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                              SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2822), with no line terminators
                              Category:downloaded
                              Size (bytes):2822
                              Entropy (8bit):5.887424482268178
                              Encrypted:false
                              SSDEEP:
                              MD5:D5F949FC3F725F466A42EDAC06390CEF
                              SHA1:530ECC1CA6A4D2E767A3F55E94368F3BE5325906
                              SHA-256:B5834978FC5C5AACE1AA6600C6270207A4CA3E7DE000BD3928E8735109B12B56
                              SHA-512:5D2FA33B318A60E1A57CB1BF02BE13F5BDEE5EE80C046129A8F4674B3B4B5A14DCC2C226C5C366A01F9D7605157C3CFFD4AAF97967F7F3E52027FD16A3B8513F
                              Malicious:false
                              Reputation:unknown
                              URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1722259691608&cv=11&fst=1722259691608&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                              Category:downloaded
                              Size (bytes):205073
                              Entropy (8bit):5.499695924393902
                              Encrypted:false
                              SSDEEP:
                              MD5:25BC1FEE269004CB6023CF2559AAE305
                              SHA1:A864DE42B5D542A340312EDE3B7C1A49FAF0643F
                              SHA-256:42E3BCA672C62DF0F945AEFC906E91EC3DA94421011B6EE2AD7E503A076DB2F8
                              SHA-512:C0F0C9589BB06455D64E3CE22EAA4934C1C263F67B68DC44CCD452D9A8D88AD7A841CCABC8EB453355B677405C8AB0C7E0EF41C04D7B2FDAD0F00149370BCD8F
                              Malicious:false
                              Reputation:unknown
                              URL:https://td.doubleclick.net/td/rul/858128210?random=1722259691275&cv=11&fst=1722259691275&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                              Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s775649074.1722259691","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s775649074.1722259691","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sw-vu9Q!2sZs8l7A!3sAAptDV7zRWyz"],"userBiddingSignals":[["475816165","596093288","7904705661","7904283812"],null,1722259692561192],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162641172153\u0026cr_id=696902420859\u0026cv_id=0\u0026format=${AD_WI
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (14539)
                              Category:downloaded
                              Size (bytes):348703
                              Entropy (8bit):5.589911716278861
                              Encrypted:false
                              SSDEEP:
                              MD5:4653D19C7634715C078B6C4FB0EAF052
                              SHA1:3DA6A91905E87FB9997E2F8D5C24D6B7CCA6CE65
                              SHA-256:1B92CEB71D1029B585A7B30F916ABB7334FB3B878CF824CF3230AEA1E6E0765C
                              SHA-512:2D3514EB369DDDE07D63E09D68572B856CE99EC965E951D9BA2AC557DA4E941110373EB4ACAA2618ECE0539D03BBEDAD417B8946EEDD997D5C85E285B1DCE3CC
                              Malicious:false
                              Reputation:unknown
                              URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":17},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":19},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":20},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":21},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR"
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2725), with no line terminators
                              Category:downloaded
                              Size (bytes):2725
                              Entropy (8bit):5.860182457327582
                              Encrypted:false
                              SSDEEP:
                              MD5:4267CE7C9129D7C5827F08DE2878D00E
                              SHA1:4CF3880C556F889F89CB82FB481D4532161AA306
                              SHA-256:7FADE044AA8D56F6A7F07404C96DD117552EACA9DCDC4418A7541B72C8736D75
                              SHA-512:7982F82AE2639BA5D0F8597F90426A186F9479905B824F1F59F57D870C044F74D2D6C41A5D021FDE807FDBB8221D276F4A65AC1538646C3F018844D89186AEC2
                              Malicious:false
                              Reputation:unknown
                              URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1722259691275&cv=11&fst=1722259691275&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (14539)
                              Category:dropped
                              Size (bytes):348729
                              Entropy (8bit):5.589908308300024
                              Encrypted:false
                              SSDEEP:
                              MD5:D91A10597F555C8FF4B944B5AB0C4762
                              SHA1:EB37981AB85266525678ECA68FAA9774C9DAFFEB
                              SHA-256:729E4F9ADE7CCB81701CB9C24DC24B04BC0E64B4A71BA956860B00A2ABCC0F9C
                              SHA-512:7577B9899DC98D75E0EE96528A1F0B5CDCF5DBE07FBD8E94CAD15F03C58171DD2F294340A7B6162F796BF96B7C0EA7A847576802FFC84DD2303483D1BCD37B3E
                              Malicious:false
                              Reputation:unknown
                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":17},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":19},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":20},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":21},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR"
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2743), with no line terminators
                              Category:dropped
                              Size (bytes):2743
                              Entropy (8bit):5.87080933223514
                              Encrypted:false
                              SSDEEP:
                              MD5:C3C5E5CB9730839F75E86B3F77593C3B
                              SHA1:90ABCF58D7985A71616C73A5400AA6ADC8ED8773
                              SHA-256:0A1290E9D0931378A35C233BF332788B7393F3FC04489490DF5D477B4ED0231E
                              SHA-512:B7027C3CBEF50E50B46BFF1BF7C5E62D8975C27790021E06B6F8B97A8229981A4C76C0711038DB3F1B1A15455E2CD7A5F55AD814BC431D2A8B6C9B65B181B2C3
                              Malicious:false
                              Reputation:unknown
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 46704, version 1.0
                              Category:downloaded
                              Size (bytes):46704
                              Entropy (8bit):7.994860687757006
                              Encrypted:true
                              SSDEEP:
                              MD5:30A274CD01B6EEB0B082C918B0697F1E
                              SHA1:393311BDE26B99A4AD935FA55BAD1DCE7994388B
                              SHA-256:88DF0B5A7BC397DBC13A26BB8B3742CC62CD1C9B0DDED57DA7832416D6F52F42
                              SHA-512:C02C5894DFB5FBF47DB7E9EDA5E0843C02E667B32E6C6844262DD5DED92DD95CC72830A336450781167BD21FBFAD35D8E74943C2817BAAC1E4CA34EAAD317777
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
                              Preview:wOF2.......p......................................O......^?HVAR.g.`?STAT.8..4/l.....<..6..f.0..\.6.$..H. ..\..>..[`....|...........7o.)....C81=......g#l..PA.c.......%...$.K.....|}}....8H.\Yd.....2c.J....0K.....I..k...F..f......,L.....P...JGwj..KM....n..,..o.....n.ck...1...%.<.....;5...9..2....=b.....("4..:.k...K_...`.5v..2@...,_.3..6..@PR.]...f!X.~..b.....-..9.....?.=:kt.'@_...N...8.i......Fo..S.C.=%.........W.@7d..%......,"h...b@.DE.]l.n..(;......E.ng].`....8..C;m....).u8.....4...%..c.A.hc]....s.{.+....J..Rq...f..I;.B..g.....j.@~.........H.........:]Dc.J.6r..].".c...8j...v. M.PXB.,.v...M..NtOO.......Z`-.i..X.....".y....c.....+..e[..(..q...u..kh.k5W..=OK{.;...7...V...I.FMTWv.Dv.[..^`......JY..:.,.. tgKhC..2-...I..S..'...IL..........p......&:..(...g..B.`......%U....-.m.D.b.m..p..26.0D.....$j.r...w..z.9.)`..n.I..B...s"es...;..vY...6.T...**..2o.....W.Lu:wx.?.7..x......C..E.^SE..F.5WcMi..a..n...X...t.........6.j.j..M.9..a.....f<J.....@.&f..'.|.....p
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2741), with no line terminators
                              Category:dropped
                              Size (bytes):2741
                              Entropy (8bit):5.884427165833924
                              Encrypted:false
                              SSDEEP:
                              MD5:7E447F95DFC0DDB4D50B2469B304BC0E
                              SHA1:38386774B47B186650DF90C39B8A2BEDCECD638B
                              SHA-256:2F3CBA89DF1EFEDE77331C968D153F31223C501A86DBDAB5C010965C4ADC9DC3
                              SHA-512:5E6CB5D195C7A9F5C95B2CA2136C0D1459D040E9A4EE30B9516A7C465A2FF075C019BA5D82039FB21D371DA832FC5154F882030687E45E7177682697EEBC64EB
                              Malicious:false
                              Reputation:unknown
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (4179)
                              Category:dropped
                              Size (bytes):272410
                              Entropy (8bit):5.544623243395372
                              Encrypted:false
                              SSDEEP:
                              MD5:761A8824D44EEC8D9A4977D58246D629
                              SHA1:07F75C6FD5425A5C30C1A5C21BB72DD4927CEC4F
                              SHA-256:010622BADADAEA2EC0A49D0C573F3DF1D00BB1D99AE3A61DEF9A703377312839
                              SHA-512:254B87AE07A3E901B642A4DCB7D0449056D911987ED1BCB587296464ABEB25072E8353D353AF62BF7614D7CF382D14F09667B58335FC5E30E20D5966817B95EF
                              Malicious:false
                              Reputation:unknown
                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (4179)
                              Category:downloaded
                              Size (bytes):272416
                              Entropy (8bit):5.544562530437873
                              Encrypted:false
                              SSDEEP:
                              MD5:A963A70952991A67459BE51EC7761445
                              SHA1:ECFDDEBB1FA7E5C5A8A5415B82AA4A434DF2F7B6
                              SHA-256:D48A95087CB1B09A702099CBC17A44605A2A8A1F26349E786B4DDD17A52BF9D3
                              SHA-512:1B905452AB6ABEC434072A946153D82B818853A301EC341868670273BB53DF61E67276E9B7BEC3FFD5602C7D55389B98CDB8B5B22EBE23DF6A0F2B9431464758
                              Malicious:false
                              Reputation:unknown
                              URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):3592
                              Entropy (8bit):4.71780114350715
                              Encrypted:false
                              SSDEEP:
                              MD5:0FFC071BC5AF33D2BE224CF147670471
                              SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                              SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                              SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (14539)
                              Category:downloaded
                              Size (bytes):348735
                              Entropy (8bit):5.589943467115565
                              Encrypted:false
                              SSDEEP:
                              MD5:8EC5DE0CD8F70789DA6C5D7C20CF0892
                              SHA1:A0BE4F340CE0FFE64E9A340D4DEB32D2C93096A6
                              SHA-256:0F39245060D70EFF0E042BA0FCE4BD9E56192D450872CFE68D29FE1D76E85BEE
                              SHA-512:BE7B2C02D60EB72DE6FC69962D4CA25C0332FCD1832EC5D3EA3F5C1873C63B0FF60F4B95E6A26734911F99F0F5077678EE44E44895A7B571B8B2BB10BACDFD46
                              Malicious:false
                              Reputation:unknown
                              URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":17},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":19},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":20},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":21},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR"
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                              Category:downloaded
                              Size (bytes):205088
                              Entropy (8bit):5.499385705763423
                              Encrypted:false
                              SSDEEP:
                              MD5:1175C4BB345A1F36E32678800B28F99E
                              SHA1:1A96F66E74A911A834E03B8C73FCABA09EA36EA8
                              SHA-256:B8F2DA40C3D87FF6DD116F3282C8E46F93E85F324AA9709A6296052A6223F036
                              SHA-512:CAFBE469B9989F4176A0087E6FF75647EB19C651CA1D3FA580C0CCD7528E5290F1CB41E8DC377F1D868BC039470324A869780B2F1DD0A025C5DEC166C3CCBA23
                              Malicious:false
                              Reputation:unknown
                              URL:https://td.doubleclick.net/td/rul/858128210?random=1722259691608&cv=11&fst=1722259691608&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                              Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s775649074.1722259691","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s775649074.1722259691","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sw-vu9Q!2sZs8l7A!3sAAptDV7zRWyz"],"userBiddingSignals":[["475816165","7904283812","7904705661","596093288"],null,1722259692861352],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162641172153\u0026cr_id=696902420859\u0026cv_id=0\u0026format=${AD_WI
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:SVG Scalable Vector Graphics image
                              Category:dropped
                              Size (bytes):2118
                              Entropy (8bit):4.907323279161229
                              Encrypted:false
                              SSDEEP:
                              MD5:1039640CF0666A1621D55C9E9FA81439
                              SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                              SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                              SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                              Malicious:false
                              Reputation:unknown
                              Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text
                              Category:downloaded
                              Size (bytes):2442
                              Entropy (8bit):5.433750282812215
                              Encrypted:false
                              SSDEEP:
                              MD5:F93FFE3E7659336BDBABD70A7D00A995
                              SHA1:24E4ACC6239D78C313521A4B3795E6B18E4DAF72
                              SHA-256:6B8A445DBDDFB9B7C56FFD4F34B6CA628A0D2C85B6A8F4DA1EDA376694377C3C
                              SHA-512:377BAEB23702D4EE906116BE7271D46C7A82963A1643B3A86D194242FBABDED0720FE939EC66AE68302BD910C6627F025FDB8D134A78DE41288B8A8DAF5EFA25
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                              Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2840), with no line terminators
                              Category:dropped
                              Size (bytes):2840
                              Entropy (8bit):5.898601671103949
                              Encrypted:false
                              SSDEEP:
                              MD5:A5C0E9A641CB8AE7ECFBAC20B0919D1D
                              SHA1:EEC15F6C13ABBF3B9BBB4A9E813D8A25524F6DAF
                              SHA-256:F4D8BBF3DA9F0C3BD8B8D2B3400D07AA4F6BB92AC9D1EE0AF68E13F4A46CA36E
                              SHA-512:70CAA7FB4B2634D589861DD94C888A4CF2B6032A59E2BC66D420B34BF30D842A71E370C66D1269A409A6CEE20BF4D968D886822EBF0F41043E518957198286E0
                              Malicious:false
                              Reputation:unknown
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                              Category:downloaded
                              Size (bytes):205052
                              Entropy (8bit):5.500174187822557
                              Encrypted:false
                              SSDEEP:
                              MD5:70FF644D8B096B3E860A4ED1ACF87BF7
                              SHA1:C8F413DE4CB2E99186DBCEAD1FFB13FBFBA01D9D
                              SHA-256:63F148FEAB9AF93FBF9A7E7C83F891D56A096DB52A5A5F0FF60EAAD626145DEF
                              SHA-512:A420EFDF3AAAE5A8969FB9E31C59688F29799D17B13F2C2FB74B7FCCC1C478E59562036E3F5B5ECBD511988A90285C964F6A49478C271FCF409C37761D61EC88
                              Malicious:false
                              Reputation:unknown
                              URL:https://td.doubleclick.net/td/rul/858128210?random=1722259691299&cv=11&fst=1722259691299&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                              Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s775649074.1722259691","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s775649074.1722259691","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sw-vu9Q!2sZs8l7A!3sAAptDV7zRWyz"],"userBiddingSignals":[["7904283812","475816165","596093288","7904705661"],null,1722259692567813],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162641172153\u0026cr_id=696902420859\u0026cv_id=0\u0026format=${AD_WI
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text, with no line terminators
                              Category:downloaded
                              Size (bytes):13
                              Entropy (8bit):2.7773627950641693
                              Encrypted:false
                              SSDEEP:
                              MD5:C83301425B2AD1D496473A5FF3D9ECCA
                              SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                              SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                              SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                              Malicious:false
                              Reputation:unknown
                              URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1115827002.1722259692&gtm=45je47o0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&z=416223017
                              Preview:<html></html>
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (2722), with no line terminators
                              Category:downloaded
                              Size (bytes):2722
                              Entropy (8bit):5.863615517463166
                              Encrypted:false
                              SSDEEP:
                              MD5:C446EBDB94FCCC356E22E28CF6477189
                              SHA1:F31C051F8687FA94F26CFB5DD577E37E87F0237C
                              SHA-256:B34D34C72D4184B47BD4DC5BE9B180081132C517451B153252FA1B003194DA74
                              SHA-512:F760B7D3D3F209A1B9083E3F58A7B584569DAFDCAE53A8831A11386B3A767E0856FAF027BD4F52449320AEFFCEFF1E923A9EEB287C18E26D50954E49AD8BB5CD
                              Malicious:false
                              Reputation:unknown
                              URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1722259691299&cv=11&fst=1722259691299&bg=ffffff&guid=ON&async=1&gtm=45be47o0v9103256652za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D0CC82742-52E4-CC1D-A08F-D3A4823E8F04%26_fcid%3D1722243095115365%26_winver%3D19045%26version%3Dfa.1091q&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=775649074.1722259691&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                              Preview:(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this||self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],p==null){k=null;break a}k=p}var r=k&&k[610401301];g=r!=null?r:!1;var t,v=f.navigator;t=v?v.userAgentData||null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&a.indexOf(d)!=-1}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return a.indexOf(d)!=-1};function y(){return g?!!t&&t.brands.length>0:!1}function z(){return y()?w("Chromium"):(x("Chrome")||x("CriOS"))&&!(y()?0:x("Edge"))||x("Silk")};!x("Android")||z();z();!x("Safari")||z()||(y()?0:x("Coast"))||(y()?0:x("Opera"))||(y()?0:x("Edge"))||(y()?w("Microsoft Edge"):x("Edg/"))||y()&&w("Opera");var A=/#|$/;function B(d){var a=d.search(A),b;a:{for(b=0;(b=d.indexOf("fmt",b))>=0&&b<a;){var c=d.charCodeAt(b-1);if(c==38||c==63)if(c=d.charCodeAt(b+3),!c||c==61||c==38||c==35)b
                              File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                              Entropy (8bit):7.226056989217363
                              TrID:
                              • Win32 Executable (generic) a (10002005/4) 99.96%
                              • Generic Win/DOS Executable (2004/3) 0.02%
                              • DOS Executable Generic (2002/1) 0.02%
                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                              File name:Setup.exe
                              File size:120'368 bytes
                              MD5:7b23662026a9d97c6f3d988dc48f02ed
                              SHA1:856ecf5cf70b21aa5072874da63c487af223e0d1
                              SHA256:78a0d6001ec4e026704814c7882cf24ac825d6706d6e5f282b7fec18b2d74587
                              SHA512:bd3773681f9b9cc3ea232f5883165849ab5bac4e8bea96e981c51c00102b2c213275297d9759128117f0e8438ba1d8b790e533da5fa89760aa46ffa22fc1e915
                              SSDEEP:3072:KbG7N2kDTHUpouDNDheVPzy5n+/mGCKHU0:KbE/HULNcVry5nmw0
                              TLSH:1CC3C05056E0C423D8A24A3079B57E7B8EB6DD2166709E4313107F587E7EF81AB1E3A3
                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........
                              Icon Hash:45d44c7192498005
                              Entrypoint:0x40352d
                              Entrypoint Section:.text
                              Digitally signed:true
                              Imagebase:0x400000
                              Subsystem:windows gui
                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                              Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                              TLS Callbacks:
                              CLR (.Net) Version:
                              OS Version Major:4
                              OS Version Minor:0
                              File Version Major:4
                              File Version Minor:0
                              Subsystem Version Major:4
                              Subsystem Version Minor:0
                              Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6
                              Signature Valid:true
                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                              Signature Validation Error:The operation completed successfully
                              Error Number:0
                              Not Before, Not After
                              • 08/05/2024 02:00:00 14/02/2025 00:59:59
                              Subject Chain
                              • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                              Version:3
                              Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                              Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                              Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                              Serial:0E5C655E1CBE9A8879372F58A5BC0302
                              Instruction
                              push ebp
                              mov ebp, esp
                              sub esp, 000003F4h
                              push ebx
                              push esi
                              push edi
                              push 00000020h
                              pop edi
                              xor ebx, ebx
                              push 00008001h
                              mov dword ptr [ebp-14h], ebx
                              mov dword ptr [ebp-04h], 0040A2E0h
                              mov dword ptr [ebp-10h], ebx
                              call dword ptr [004080CCh]
                              mov esi, dword ptr [004080D0h]
                              lea eax, dword ptr [ebp-00000140h]
                              push eax
                              mov dword ptr [ebp-0000012Ch], ebx
                              mov dword ptr [ebp-2Ch], ebx
                              mov dword ptr [ebp-28h], ebx
                              mov dword ptr [ebp-00000140h], 0000011Ch
                              call esi
                              test eax, eax
                              jne 00007EFD8119C76Ah
                              lea eax, dword ptr [ebp-00000140h]
                              mov dword ptr [ebp-00000140h], 00000114h
                              push eax
                              call esi
                              mov ax, word ptr [ebp-0000012Ch]
                              mov ecx, dword ptr [ebp-00000112h]
                              sub ax, 00000053h
                              add ecx, FFFFFFD0h
                              neg ax
                              sbb eax, eax
                              mov byte ptr [ebp-26h], 00000004h
                              not eax
                              and eax, ecx
                              mov word ptr [ebp-2Ch], ax
                              cmp dword ptr [ebp-0000013Ch], 0Ah
                              jnc 00007EFD8119C73Ah
                              and word ptr [ebp-00000132h], 0000h
                              mov eax, dword ptr [ebp-00000134h]
                              movzx ecx, byte ptr [ebp-00000138h]
                              mov dword ptr [00434FB8h], eax
                              xor eax, eax
                              mov ah, byte ptr [ebp-0000013Ch]
                              movzx eax, ax
                              or eax, ecx
                              xor ecx, ecx
                              mov ch, byte ptr [ebp-2Ch]
                              movzx ecx, cx
                              shl eax, 10h
                              or eax, ecx
                              Programming Language:
                              • [EXP] VC++ 6.0 SP5 build 8804
                              NameVirtual AddressVirtual Size Is in Section
                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                              IMAGE_DIRECTORY_ENTRY_SECURITY0x1acc80x2968.data
                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                              .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                              .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                              .rsrc0x6c0000x4f400x50001bd1c8ed7bf3294c8d8325495a85db02False0.10146484375data2.760729592452911IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              NameRVASizeTypeLanguageCountryZLIB Complexity
                              RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                              RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                              RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                              RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                              RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                              RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                              RT_VERSION0x708d80x240dataEnglishUnited States0.4878472222222222
                              RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076
                              DLLImport
                              ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                              SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                              ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                              COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                              USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                              GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                              KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW
                              Language of compilation systemCountry where language is spokenMap
                              EnglishUnited States